From 81553bb3c47590aecc04283b0b77682ecc5c2226 Mon Sep 17 00:00:00 2001 From: Shubhangi-Microsoft Date: Mon, 18 May 2026 15:18:19 +0530 Subject: [PATCH 1/6] Enable Data Loss Prevention on Cognitive Services account Add restrictOutboundNetworkAccess: true to AI Services module in both main.bicep and main_custom.bicep to comply with SFI control Azure_ComputerVision_DP_Data_Loss_Prevention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- infra/main.bicep | 1 + infra/main_custom.bicep | 1 + 2 files changed, 2 insertions(+) diff --git a/infra/main.bicep b/infra/main.bicep index 7609800a..286fa1d6 100644 --- a/infra/main.bicep +++ b/infra/main.bicep @@ -836,6 +836,7 @@ module aiFoundryAiServices 'br:mcr.microsoft.com/bicep/avm/res/cognitive-service // WAF aligned configuration for Monitoring diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' + restrictOutboundNetworkAccess: true privateEndpoints: [] } } diff --git a/infra/main_custom.bicep b/infra/main_custom.bicep index 550564fe..762c7144 100644 --- a/infra/main_custom.bicep +++ b/infra/main_custom.bicep @@ -839,6 +839,7 @@ module aiFoundryAiServices 'br:mcr.microsoft.com/bicep/avm/res/cognitive-service // WAF aligned configuration for Monitoring diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' + restrictOutboundNetworkAccess: true privateEndpoints: [] } } From b82a4ce98e6d9f04234766650276b11932759c32 Mon Sep 17 00:00:00 2001 From: Shubhangi-Microsoft Date: Mon, 18 May 2026 15:49:54 +0530 Subject: [PATCH 2/6] Address PR review: e2e TLS, search local auth, VM audit logs - Add e2eEncryptionEnabled: true to backend API app service - Set disableLocalAuth: true on search service (removed conflicting authOptions block as Azure requires it to be null when local auth is disabled) - Update VM data collection rule xPathQuery to capture Audit Success and Audit Failure events using Keywords bitmask filter - Add Microsoft-Event data flow for security event forwarding - Add allowedFqdnList for Search Service on AI Services to ensure agents can reach Search while DLP (restrictOutboundNetworkAccess) is enabled Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- infra/main.bicep | 25 +++++++++++++++++-------- infra/main_custom.bicep | 25 +++++++++++++++++-------- 2 files changed, 34 insertions(+), 16 deletions(-) diff --git a/infra/main.bicep b/infra/main.bicep index 286fa1d6..17c4de64 100644 --- a/infra/main.bicep +++ b/infra/main.bicep @@ -463,10 +463,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- { name: 'SecurityAuditEvents' streams: [ - 'Microsoft-WindowsEvent' + 'Microsoft-Event' ] xPathQueries: [ - 'Security!*[System[(EventID=4624 or EventID=4625)]]' + 'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]' ] } ] @@ -490,6 +490,16 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- transformKql: 'source' outputStream: 'Microsoft-Perf' } + { + streams: [ + 'Microsoft-Event' + ] + destinations: [ + 'la--1264800308' + ] + transformKql: 'source' + outputStream: 'Microsoft-Event' + } ] } } @@ -837,6 +847,9 @@ module aiFoundryAiServices 'br:mcr.microsoft.com/bicep/avm/res/cognitive-service diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' restrictOutboundNetworkAccess: true + allowedFqdnList: [ + '${searchServiceName}.search.windows.net' + ] privateEndpoints: [] } } @@ -894,12 +907,7 @@ module searchServiceUpdate 'br/public:avm/res/search/search-service:0.12.0' = { params: { name: searchServiceName location: location - authOptions: { - aadOrApiKey: { - aadAuthFailureMode: 'http401WithBearerChallenge' - } - } - disableLocalAuth: false + disableLocalAuth: true hostingMode: 'Default' managedIdentities: { systemAssigned: true } publicNetworkAccess: 'Enabled' @@ -1195,6 +1203,7 @@ module webSiteBackend 'modules/web-sites.bicep' = { } virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webserverfarmSubnetResourceId : null publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' + e2eEncryptionEnabled: true privateEndpoints: enablePrivateNetworking ? [ { diff --git a/infra/main_custom.bicep b/infra/main_custom.bicep index 762c7144..c5475b7d 100644 --- a/infra/main_custom.bicep +++ b/infra/main_custom.bicep @@ -466,10 +466,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- { name: 'SecurityAuditEvents' streams: [ - 'Microsoft-WindowsEvent' + 'Microsoft-Event' ] xPathQueries: [ - 'Security!*[System[(EventID=4624 or EventID=4625)]]' + 'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]' ] } ] @@ -493,6 +493,16 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- transformKql: 'source' outputStream: 'Microsoft-Perf' } + { + streams: [ + 'Microsoft-Event' + ] + destinations: [ + 'la--1264800308' + ] + transformKql: 'source' + outputStream: 'Microsoft-Event' + } ] } } @@ -840,6 +850,9 @@ module aiFoundryAiServices 'br:mcr.microsoft.com/bicep/avm/res/cognitive-service diagnosticSettings: enableMonitoring ? [{ workspaceResourceId: logAnalyticsWorkspaceResourceId }] : null publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' restrictOutboundNetworkAccess: true + allowedFqdnList: [ + '${searchServiceName}.search.windows.net' + ] privateEndpoints: [] } } @@ -886,12 +899,7 @@ module searchService 'br/public:avm/res/search/search-service:0.12.0' = { name: take('avm.res.search.search-service.${solutionSuffix}', 64) params: { name: searchServiceName - authOptions: { - aadOrApiKey: { - aadAuthFailureMode: 'http401WithBearerChallenge' - } - } - disableLocalAuth: false + disableLocalAuth: true hostingMode: 'Default' managedIdentities: { systemAssigned: true @@ -1184,6 +1192,7 @@ module webSiteBackend 'modules/web-sites.bicep' = { } virtualNetworkSubnetId: enablePrivateNetworking ? virtualNetwork!.outputs.webserverfarmSubnetResourceId : null publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled' + e2eEncryptionEnabled: true privateEndpoints: enablePrivateNetworking ? [ { From 09905ae547616905e4452cc66731312a4ee2bfe5 Mon Sep 17 00:00:00 2001 From: Shubhangi-Microsoft Date: Tue, 19 May 2026 10:52:55 +0530 Subject: [PATCH 3/6] Rebuild main.json from updated main.bicep Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- infra/main.json | 92 ++++++++++++++++++++++++++++--------------------- 1 file changed, 53 insertions(+), 39 deletions(-) diff --git a/infra/main.json b/infra/main.json index 533d48be..6a10e34d 100644 --- a/infra/main.json +++ b/infra/main.json @@ -5,8 +5,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "11387055216723929134" + "version": "0.43.8.12551", + "templateHash": "15254096639975874843" } }, "parameters": { @@ -4420,8 +4420,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "14206227996098979620" + "version": "0.43.8.12551", + "templateHash": "3334983351757312195" } }, "definitions": { @@ -9518,10 +9518,10 @@ { "name": "SecurityAuditEvents", "streams": [ - "Microsoft-WindowsEvent" + "Microsoft-Event" ], "xPathQueries": [ - "Security!*[System[(EventID=4624 or EventID=4625)]]" + "Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]" ] } ] @@ -9544,6 +9544,16 @@ ], "transformKql": "source", "outputStream": "Microsoft-Perf" + }, + { + "streams": [ + "Microsoft-Event" + ], + "destinations": [ + "la--1264800308" + ], + "transformKql": "source", + "outputStream": "Microsoft-Event" } ] } @@ -23733,8 +23743,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "17764186322048334660" + "version": "0.43.8.12551", + "templateHash": "5288388528788440524" } }, "definitions": { @@ -24164,6 +24174,14 @@ }, "diagnosticSettings": "[if(parameters('enableMonitoring'), createObject('value', createArray(createObject('workspaceResourceId', if(variables('useExistingLogAnalytics'), parameters('existingLogAnalyticsWorkspaceId'), reference('logAnalyticsWorkspace').outputs.resourceId.value)))), createObject('value', null()))]", "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "restrictOutboundNetworkAccess": { + "value": true + }, + "allowedFqdnList": { + "value": [ + "[format('{0}.search.windows.net', variables('searchServiceName'))]" + ] + }, "privateEndpoints": { "value": [] } @@ -27296,9 +27314,9 @@ }, "dependsOn": [ "aiFoundryAiServices", + "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]", "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]", "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]", - "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]", "virtualNetwork" ] }, @@ -27318,15 +27336,8 @@ "location": { "value": "[parameters('location')]" }, - "authOptions": { - "value": { - "aadOrApiKey": { - "aadAuthFailureMode": "http401WithBearerChallenge" - } - } - }, "disableLocalAuth": { - "value": false + "value": true }, "hostingMode": { "value": "Default" @@ -29450,8 +29461,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "977847065221098560" + "version": "0.43.8.12551", + "templateHash": "1735625309877492934" } }, "parameters": { @@ -29550,8 +29561,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "5411608621965957651" + "version": "0.43.8.12551", + "templateHash": "1433080150197323850" } }, "parameters": { @@ -36435,6 +36446,9 @@ }, "virtualNetworkSubnetId": "[if(parameters('enablePrivateNetworking'), createObject('value', reference('virtualNetwork').outputs.webserverfarmSubnetResourceId.value), createObject('value', null()))]", "publicNetworkAccess": "[if(parameters('enablePrivateNetworking'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]", + "e2eEncryptionEnabled": { + "value": true + }, "privateEndpoints": "[if(parameters('enablePrivateNetworking'), createObject('value', createArray(createObject('name', format('pep-{0}', variables('backendWebSiteResourceName')), 'customNetworkInterfaceName', format('nic-{0}', variables('backendWebSiteResourceName')), 'privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', reference(format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').webApp)).outputs.resourceId.value))), 'service', 'sites', 'subnetResourceId', reference('virtualNetwork').outputs.backendSubnetResourceId.value))), createObject('value', createArray()))]" }, "template": { @@ -36444,8 +36458,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "13609531051773905187" + "version": "0.43.8.12551", + "templateHash": "15490584693408563123" } }, "definitions": { @@ -37451,8 +37465,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "11459765709838723797" + "version": "0.43.8.12551", + "templateHash": "16163995530530399452" }, "name": "Site App Settings", "description": "This module deploys a Site App Setting." @@ -38374,8 +38388,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "211794335954355709" + "version": "0.43.8.12551", + "templateHash": "11416468254207116029" } }, "parameters": { @@ -38494,8 +38508,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "211794335954355709" + "version": "0.43.8.12551", + "templateHash": "11416468254207116029" } }, "parameters": { @@ -38608,8 +38622,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "211794335954355709" + "version": "0.43.8.12551", + "templateHash": "11416468254207116029" } }, "parameters": { @@ -38725,8 +38739,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "211794335954355709" + "version": "0.43.8.12551", + "templateHash": "11416468254207116029" } }, "parameters": { @@ -38843,8 +38857,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "211794335954355709" + "version": "0.43.8.12551", + "templateHash": "11416468254207116029" } }, "parameters": { @@ -38998,8 +39012,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "13609531051773905187" + "version": "0.43.8.12551", + "templateHash": "15490584693408563123" } }, "definitions": { @@ -40005,8 +40019,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.42.1.51946", - "templateHash": "11459765709838723797" + "version": "0.43.8.12551", + "templateHash": "16163995530530399452" }, "name": "Site App Settings", "description": "This module deploys a Site App Setting." From 3d2b8844dbac2ef60d8733ced9b32a6aba851ad7 Mon Sep 17 00:00:00 2001 From: Shubhangi-Microsoft Date: Tue, 19 May 2026 11:48:50 +0530 Subject: [PATCH 4/6] Address PR review: document Keywords bitmask and normalize main.json line endings --- infra/main.bicep | 4 ++++ infra/main.json | 8 ++++---- infra/main_custom.bicep | 4 ++++ 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/infra/main.bicep b/infra/main.bicep index 15fd4f6f..ab33b546 100644 --- a/infra/main.bicep +++ b/infra/main.bicep @@ -465,6 +465,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- streams: [ 'Microsoft-Event' ] + // Keywords bitmask 13510798882111488 = 0x30000000000000 selects Audit Success (0x20000000000000) + // and Audit Failure (0x10000000000000) security events. EventID 4624 (successful logon) is + // excluded to reduce noise while still capturing logon failures (4625) and other audited activity. + // Required by SFI control Azure_VirtualMachine_Audit_Enable_DataCollectionRule. xPathQueries: [ 'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]' ] diff --git a/infra/main.json b/infra/main.json index 6a10e34d..4ca132d8 100644 --- a/infra/main.json +++ b/infra/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.43.8.12551", - "templateHash": "15254096639975874843" + "templateHash": "422194726574799670" } }, "parameters": { @@ -381,7 +381,7 @@ } ], "webServerFarmResourceName": "[format('asp-{0}', variables('solutionSuffix'))]", - "reactAppLayoutConfig": "{\r\n \"appConfig\": {\r\n \"CHAT_CHATHISTORY\": {\r\n \"CHAT\": 70,\r\n \"CHATHISTORY\": 30\r\n }\r\n }\r\n }\r\n}", + "reactAppLayoutConfig": "{\n \"appConfig\": {\n \"CHAT_CHATHISTORY\": {\n \"CHAT\": 70,\n \"CHATHISTORY\": 30\n }\n }\n }\n}", "backendWebSiteResourceName": "[format('api-{0}', variables('solutionSuffix'))]", "aiProjectResourceId": "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectResourceName'))]", "webSiteResourceName": "[format('app-{0}', variables('solutionSuffix'))]" @@ -27314,9 +27314,9 @@ }, "dependsOn": [ "aiFoundryAiServices", - "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]", - "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]", "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]", + "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]", + "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]", "virtualNetwork" ] }, diff --git a/infra/main_custom.bicep b/infra/main_custom.bicep index dcd98953..af908a09 100644 --- a/infra/main_custom.bicep +++ b/infra/main_custom.bicep @@ -468,6 +468,10 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- streams: [ 'Microsoft-Event' ] + // Keywords bitmask 13510798882111488 = 0x30000000000000 selects Audit Success (0x20000000000000) + // and Audit Failure (0x10000000000000) security events. EventID 4624 (successful logon) is + // excluded to reduce noise while still capturing logon failures (4625) and other audited activity. + // Required by SFI control Azure_VirtualMachine_Audit_Enable_DataCollectionRule. xPathQueries: [ 'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]' ] From 3fc361163f1c29ec4c7efe49de124243cd473187 Mon Sep 17 00:00:00 2001 From: Shubhangi-Microsoft Date: Wed, 20 May 2026 15:45:08 +0530 Subject: [PATCH 5/6] Replace hardcoded DCR destination name with dynamic variable Replace opaque hardcoded destination name 'la--1264800308' with a variable dcrLogAnalyticsDestinationName that derives from the Log Analytics workspace resource name, keeping the destinations block and dataFlows references in sync across deployments. Addresses SFI review finding for Data Collection Rule configuration. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- infra/main.bicep | 7 ++++--- infra/main.json | 13 +++++++------ infra/main_custom.bicep | 7 ++++--- 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/infra/main.bicep b/infra/main.bicep index ab33b546..86be460e 100644 --- a/infra/main.bicep +++ b/infra/main.bicep @@ -388,6 +388,7 @@ module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-confi } } +var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination' var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}' var dataCollectionRulesLocation = useExistingLogAnalytics ? existingLogAnalyticsWorkspace!.location @@ -479,7 +480,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- logAnalytics: [ { workspaceResourceId: logAnalyticsWorkspaceResourceId - name: 'la--1264800308' + name: dcrLogAnalyticsDestinationName } ] } @@ -489,7 +490,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- 'Microsoft-Perf' ] destinations: [ - 'la--1264800308' + dcrLogAnalyticsDestinationName ] transformKql: 'source' outputStream: 'Microsoft-Perf' @@ -499,7 +500,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- 'Microsoft-Event' ] destinations: [ - 'la--1264800308' + dcrLogAnalyticsDestinationName ] transformKql: 'source' outputStream: 'Microsoft-Event' diff --git a/infra/main.json b/infra/main.json index 4ca132d8..5d016fec 100644 --- a/infra/main.json +++ b/infra/main.json @@ -6,7 +6,7 @@ "_generator": { "name": "bicep", "version": "0.43.8.12551", - "templateHash": "422194726574799670" + "templateHash": "14388241547075542875" } }, "parameters": { @@ -277,6 +277,7 @@ "virtualNetworkResourceName": "[format('vnet-{0}', variables('solutionSuffix'))]", "bastionResourceName": "[format('bas-{0}', variables('solutionSuffix'))]", "maintenanceConfigurationResourceName": "[format('mc-{0}', variables('solutionSuffix'))]", + "dcrLogAnalyticsDestinationName": "[format('la-{0}-destination', variables('logAnalyticsWorkspaceResourceName'))]", "dataCollectionRulesResourceName": "[format('dcr-{0}', variables('solutionSuffix'))]", "proximityPlacementGroupResourceName": "[format('ppg-{0}', variables('solutionSuffix'))]", "virtualMachineResourceName": "[format('vm-{0}', variables('solutionSuffix'))]", @@ -381,7 +382,7 @@ } ], "webServerFarmResourceName": "[format('asp-{0}', variables('solutionSuffix'))]", - "reactAppLayoutConfig": "{\n \"appConfig\": {\n \"CHAT_CHATHISTORY\": {\n \"CHAT\": 70,\n \"CHATHISTORY\": 30\n }\n }\n }\n}", + "reactAppLayoutConfig": "{\r\n \"appConfig\": {\r\n \"CHAT_CHATHISTORY\": {\r\n \"CHAT\": 70,\r\n \"CHATHISTORY\": 30\r\n }\r\n }\r\n }\r\n}", "backendWebSiteResourceName": "[format('api-{0}', variables('solutionSuffix'))]", "aiProjectResourceId": "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectResourceName'))]", "webSiteResourceName": "[format('app-{0}', variables('solutionSuffix'))]" @@ -9530,7 +9531,7 @@ "logAnalytics": [ { "workspaceResourceId": "[if(variables('useExistingLogAnalytics'), parameters('existingLogAnalyticsWorkspaceId'), reference('logAnalyticsWorkspace').outputs.resourceId.value)]", - "name": "la--1264800308" + "name": "[variables('dcrLogAnalyticsDestinationName')]" } ] }, @@ -9540,7 +9541,7 @@ "Microsoft-Perf" ], "destinations": [ - "la--1264800308" + "[variables('dcrLogAnalyticsDestinationName')]" ], "transformKql": "source", "outputStream": "Microsoft-Perf" @@ -9550,7 +9551,7 @@ "Microsoft-Event" ], "destinations": [ - "la--1264800308" + "[variables('dcrLogAnalyticsDestinationName')]" ], "transformKql": "source", "outputStream": "Microsoft-Event" @@ -27314,9 +27315,9 @@ }, "dependsOn": [ "aiFoundryAiServices", + "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]", "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').aiServices)]", "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').cognitiveServices)]", - "[format('avmPrivateDnsZones[{0}]', variables('dnsZoneIndex').openAI)]", "virtualNetwork" ] }, diff --git a/infra/main_custom.bicep b/infra/main_custom.bicep index af908a09..e7274037 100644 --- a/infra/main_custom.bicep +++ b/infra/main_custom.bicep @@ -391,6 +391,7 @@ module maintenanceConfiguration 'br/public:avm/res/maintenance/maintenance-confi } } +var dcrLogAnalyticsDestinationName = 'la-${logAnalyticsWorkspaceResourceName}-destination' var dataCollectionRulesResourceName = 'dcr-${solutionSuffix}' var dataCollectionRulesLocation = useExistingLogAnalytics ? existingLogAnalyticsWorkspace!.location @@ -482,7 +483,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- logAnalytics: [ { workspaceResourceId: logAnalyticsWorkspaceResourceId - name: 'la--1264800308' + name: dcrLogAnalyticsDestinationName } ] } @@ -492,7 +493,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- 'Microsoft-Perf' ] destinations: [ - 'la--1264800308' + dcrLogAnalyticsDestinationName ] transformKql: 'source' outputStream: 'Microsoft-Perf' @@ -502,7 +503,7 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- 'Microsoft-Event' ] destinations: [ - 'la--1264800308' + dcrLogAnalyticsDestinationName ] transformKql: 'source' outputStream: 'Microsoft-Event' From 80c8461cc7415771989c5ffac7bc166f37d44e0a Mon Sep 17 00:00:00 2001 From: Shubhangi-Microsoft Date: Wed, 20 May 2026 17:11:01 +0530 Subject: [PATCH 6/6] Resolve PR comments: tighten DCR XPath query and normalize line endings in main.json - Replace broad Keywords bitmask filter with explicit high-value security Event IDs (4625, 4648, 4672, 4719, 4720, 4722, 4724-4726, 4732, 4740, 4756) in main_custom.bicep - Rebuild main.json from main.bicep - Normalize reactAppLayoutConfig line endings from CRLF to LF in main.json Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- infra/main.json | 2 +- infra/main_custom.bicep | 15 ++++++++++----- 2 files changed, 11 insertions(+), 6 deletions(-) diff --git a/infra/main.json b/infra/main.json index 5d016fec..cd66dd35 100644 --- a/infra/main.json +++ b/infra/main.json @@ -382,7 +382,7 @@ } ], "webServerFarmResourceName": "[format('asp-{0}', variables('solutionSuffix'))]", - "reactAppLayoutConfig": "{\r\n \"appConfig\": {\r\n \"CHAT_CHATHISTORY\": {\r\n \"CHAT\": 70,\r\n \"CHATHISTORY\": 30\r\n }\r\n }\r\n }\r\n}", + "reactAppLayoutConfig": "{\n \"appConfig\": {\n \"CHAT_CHATHISTORY\": {\n \"CHAT\": 70,\n \"CHATHISTORY\": 30\n }\n }\n }\n}", "backendWebSiteResourceName": "[format('api-{0}', variables('solutionSuffix'))]", "aiProjectResourceId": "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryAiServicesResourceName'), variables('aiFoundryAiProjectResourceName'))]", "webSiteResourceName": "[format('app-{0}', variables('solutionSuffix'))]" diff --git a/infra/main_custom.bicep b/infra/main_custom.bicep index e7274037..2c112e0d 100644 --- a/infra/main_custom.bicep +++ b/infra/main_custom.bicep @@ -469,12 +469,17 @@ module windowsVmDataCollectionRules 'br/public:avm/res/insights/data-collection- streams: [ 'Microsoft-Event' ] - // Keywords bitmask 13510798882111488 = 0x30000000000000 selects Audit Success (0x20000000000000) - // and Audit Failure (0x10000000000000) security events. EventID 4624 (successful logon) is - // excluded to reduce noise while still capturing logon failures (4625) and other audited activity. - // Required by SFI control Azure_VirtualMachine_Audit_Enable_DataCollectionRule. + // Collect high-value Security audit events required by SFI control + // Azure_VirtualMachine_Audit_Enable_DataCollectionRule. + // Scoped to specific Event IDs to limit ingestion cost: + // 4625 - Failed logon 4648 - Explicit credential logon + // 4672 - Special privileges 4719 - Audit policy changed + // 4720 - Account created 4722 - Account enabled + // 4724 - Password reset 4725 - Account disabled + // 4726 - Account deleted 4732 - Member added to local group + // 4740 - Account locked out 4756 - Member added to universal group xPathQueries: [ - 'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]' + 'Security!*[System[(EventID=4625 or EventID=4648 or EventID=4672 or EventID=4719 or EventID=4720 or EventID=4722 or EventID=4724 or EventID=4725 or EventID=4726 or EventID=4732 or EventID=4740 or EventID=4756)]]' ] } ]