diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 7cb0887a..3b8b2f66 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -219,7 +219,7 @@ jobs: echo "Log Analytics workspace name: ${log_analytics_workspace_name}" fi - echo "Fetching AI Services (OpenAI) resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..." + echo "Fetching AI Services (Azure OpenAI) resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..." # Run the az resource list command to get the AI Services resource name ai_services_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.CognitiveServices/accounts" --query "[0].name" -o tsv) @@ -231,16 +231,16 @@ jobs: echo "AI Services resource name: ${ai_services_name}" fi - echo "Fetching AI Search resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..." + echo "Fetching Azure AI Search resource from resource group ${{ env.RESOURCE_GROUP_NAME }}..." - # Run the az resource list command to get the AI Search resource name + # Run the az resource list command to get the Azure AI Search resource name ai_search_name=$(az resource list --resource-group ${{ env.RESOURCE_GROUP_NAME }} --resource-type "Microsoft.Search/searchServices" --query "[0].name" -o tsv) if [ -z "$ai_search_name" ]; then - echo "No AI Search resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}." + echo "No Azure AI Search resource found in resource group ${{ env.RESOURCE_GROUP_NAME }}." else echo "AI_SEARCH_NAME=${ai_search_name}" >> $GITHUB_ENV - echo "AI Search resource name: ${ai_search_name}" + echo "Azure AI Search resource name: ${ai_search_name}" fi - name: List KeyVaults and Store in Array @@ -384,7 +384,7 @@ jobs: run: | set -e - # Purge AI Services Resource (includes OpenAI) + # Purge AI Services Resource (includes Azure OpenAI) if [ ! -z "${{ env.AI_SERVICES_NAME }}" ]; then echo "AI Services: ${{ env.AI_SERVICES_NAME }}" echo "Purging the AI Services Resource..." @@ -447,4 +447,4 @@ jobs: if: always() run: | az logout - echo "Logged out from Azure." \ No newline at end of file + echo "Logged out from Azure." diff --git a/.github/workflows/job-post-deploy.yml b/.github/workflows/job-post-deploy.yml index 4a412ed7..e2c11e81 100644 --- a/.github/workflows/job-post-deploy.yml +++ b/.github/workflows/job-post-deploy.yml @@ -59,7 +59,7 @@ jobs: NETWORK_TOGGLE_ONLY: enable INPUT_RESOURCE_GROUP_NAME: ${{ inputs.RESOURCE_GROUP_NAME }} run: | - echo "πŸ”“ Opening Cosmos DB / AI Foundry public access so Python SDK calls can reach them..." + echo "πŸ”“ Opening Azure Cosmos DB / Azure AI Foundry public access so Python SDK calls can reach them..." cd $GITHUB_WORKSPACE bash ./infra/scripts/post-provision/data_scripts/run_upload_data_scripts.sh --resource-group "$INPUT_RESOURCE_GROUP_NAME" diff --git a/README.md b/README.md index 74352e42..e4fe51aa 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Customer Chatbot Solution Accelerator -This solution accelerator empowers organizations to build intelligent, conversational customer service experiences by leveraging Microsoft Foundry's Agent Framework. With seamless integration of specialized AI agents and enterprise-grade data services, teams can create chatbots that answer catalog and policy questions and deliver exceptional support across industry scenarios. The solution pairs a scenario host application (ecommerce, healthcare, or banking) with an embeddable chat widget backed by an orchestrator agent that routes customer queries to specialized agents (catalog/product lookup and policy/knowledge), ensuring accurate, contextual responses grounded in scenario data. By unifying AI capabilities with scalable cloud infrastructure, organizations can deliver 24/7 customer support that understands context, maintains conversation history, and provides actionable insights to improve customer satisfaction and operational efficiency. +This solution accelerator empowers organizations to build intelligent, conversational customer service experiences by leveraging Azure AI Foundry's Agent Framework. With seamless integration of specialized AI agents and enterprise-grade data services, teams can create chatbots that answer catalog and policy questions and deliver exceptional support across industry scenarios. The solution pairs a scenario host application (ecommerce, healthcare, or banking) with an embeddable chat widget backed by an orchestrator agent that routes customer queries to specialized agents (catalog/product lookup and policy/knowledge), ensuring accurate, contextual responses grounded in scenario data. By unifying AI capabilities with scalable cloud infrastructure, organizations can deliver 24/7 customer support that understands context, maintains conversation history, and provides actionable insights to improve customer satisfaction and operational efficiency. --- @@ -12,7 +12,7 @@ This solution accelerator empowers organizations to build intelligent, conversat ## Solution overview -Leverages Microsoft Foundry's Agent Framework, Foundry IQ, and Azure Cosmos DB to create an intelligent customer chatbot with specialized agents for catalog lookup and knowledge management. Deploy one industry scenario per environmentβ€”**ecommerce**, **healthcare**, or **banking**. Each deployment includes a scenario host UI for browsing catalog content and an embedded chat widget (text and voice) that uses an orchestrator agent to route queries to specialized agents. Those agents use hybrid search across catalog and policy documents to return accurate, contextual answers. +Leverages Azure AI Foundry's Agent Framework, Foundry IQ, and Azure Cosmos DB to create an intelligent customer chatbot with specialized agents for catalog lookup and knowledge management. Deploy one industry scenario per environmentβ€”**ecommerce**, **healthcare**, or **banking**. Each deployment includes a scenario host UI for browsing catalog content and an embedded chat widget (text and voice) that uses an orchestrator agent to route queries to specialized agents. Those agents use hybrid search across catalog and policy documents to return accurate, contextual answers. ### Solution architecture @@ -47,7 +47,7 @@ For detailed technical information, see the component READMEs: Click to learn more about the key features this solution enables - **Intelligent agent orchestration using Microsoft Agent Framework** - Leverage Microsoft Foundry's Agent Framework with an orchestrator agent that uses automatic tool selection to route customer queries to specialized agents (catalog/product lookup and policy/knowledge). The orchestrator analyzes user intent and automatically invokes the appropriate specialist agent as a tool, ensuring queries are handled by the most capable agent for each task. + Leverage Azure AI Foundry's Agent Framework with an orchestrator agent that uses automatic tool selection to route customer queries to specialized agents (catalog/product lookup and policy/knowledge). The orchestrator analyzes user intent and automatically invokes the appropriate specialist agent as a tool, ensuring queries are handled by the most capable agent for each task. - **Multi-scenario deployment** Choose **ecommerce** (Contoso Paints), **healthcare** (Contoso Health), or **banking** (Contoso Banking) per environment. Each scenario packs its own host UI, API surface, search indexes, seed data, and Foundry agent instructions under `scenarios/`. @@ -59,7 +59,7 @@ For detailed technical information, see the component READMEs: Foundry IQ provides fast, accurate catalog and policy document retrieval using semantic and keyword search, enabling natural language queries across industry knowledge bases. Specialized agents access scenario-specific search indexes to retrieve relevant information. - **Natural language interaction** - Microsoft Foundry's Agent Framework orchestrates multi-agent workflows using GPT-5.4-mini to deliver conversational, context-aware responses that understand customer intent. The framework maintains conversation threads and context across sessions, enabling natural, flowing conversations with specialized agents. Voice Live uses the same Foundry pipeline with scenario-aware grounding. + Azure AI Foundry's Agent Framework orchestrates multi-agent workflows using GPT-5.4-mini to deliver conversational, context-aware responses that understand customer intent. The framework maintains conversation threads and context across sessions, enabling natural, flowing conversations with specialized agents. Voice Live uses the same Foundry pipeline with scenario-aware grounding. - **Modern scenario host experience** React-based host frontend for browsing the industry catalog (paints, clinical services, or banking products) with an integrated floating chat assistant for seamless discovery and support @@ -119,8 +119,8 @@ _Note: This is not meant to outline all costs as selected SKUs, scaled use, cust | Product | Description | Tier / Expected Usage Notes | Cost | |---|---|---|---| -| [Microsoft Foundry](https://learn.microsoft.com/en-us/azure/ai-foundry) | Used to orchestrate and build AI workflows with specialized agents for customer service. | Free Tier | [Pricing](https://azure.microsoft.com/pricing/details/ai-studio/) | -| [Azure AI Services (OpenAI)](https://learn.microsoft.com/en-us/azure/cognitive-services/openai/overview) | Enables language understanding, chat, and realtime voice (Voice Live) using GPT models for conversational AI. | S0 Tier; pricing depends on token volume and model used (e.g., GPT-5.4-mini, gpt-realtime-mini). | [Pricing](https://azure.microsoft.com/pricing/details/cognitive-services/) | +| [Azure AI Foundry](https://learn.microsoft.com/en-us/azure/ai-foundry) | Used to orchestrate and build AI workflows with specialized agents for customer service. | Free Tier | [Pricing](https://azure.microsoft.com/pricing/details/ai-studio/) | +| [Azure AI Services (Azure OpenAI)](https://learn.microsoft.com/en-us/azure/cognitive-services/openai/overview) | Enables language understanding, chat, and realtime voice (Voice Live) using GPT models for conversational AI. | S0 Tier; pricing depends on token volume and model used (e.g., GPT-5.4-mini, gpt-realtime-mini). | [Pricing](https://azure.microsoft.com/pricing/details/cognitive-services/) | | [Foundry IQ](https://learn.microsoft.com/en-us/azure/search/search-what-is-azure-search) | Provides hybrid search capabilities for scenario catalogs and policy documents with semantic and keyword search. | Basic Tier; pricing based on search units and data storage. | [Pricing](https://azure.microsoft.com/pricing/details/search/) | | [Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/overview) | Hosts the scenario and chat frontend apps and FastAPI backends. | Basic or Standard plan; includes a free tier for development. | [Pricing](https://azure.microsoft.com/pricing/details/app-service/windows/) | | [Azure Container Registry](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-intro) | Stores and serves container images used by Azure App Service. | Basic Tier; fixed daily cost per registry. | [Pricing](https://azure.microsoft.com/pricing/details/container-registry/) | @@ -194,7 +194,7 @@ Ship a single chat widget and backend that plug into different industry hosts. S - **Scalable and maintainable architecture** -Deliver consistent customer experiences at scale with a separation between the industry host and the chat service. The Microsoft Foundry Agent Framework enables easy extension with new agents, scenarios, or data sources as business needs evolve. +Deliver consistent customer experiences at scale with a separation between the industry host and the chat service. The Azure AI Foundry Agent Framework enables easy extension with new agents, scenarios, or data sources as business needs evolve. diff --git a/azure.yaml b/azure.yaml index 97cab5f3..581f0c89 100644 --- a/azure.yaml +++ b/azure.yaml @@ -57,7 +57,7 @@ hooks: Write-Host "1. Build and push the backend/frontend container images to ACR, then point the web apps at them:`n" Write-Host " infra\scripts\post-provision\build_push_images.ps1`n" -ForegroundColor Cyan - Write-Host "2. Load data and create AI Foundry agents:`n" + Write-Host "2. Load data and create Azure AI Foundry agents:`n" Write-Host " Option A - Run both stages at once (recommended):`n" -ForegroundColor White Write-Host " infra\scripts\post-provision\postprovision_data_agents.ps1`n" -ForegroundColor Cyan Write-Host " Option B - Run each stage individually:`n" -ForegroundColor White @@ -88,7 +88,7 @@ hooks: echo " bash ./infra/scripts/post-provision/build_push_images.sh" echo "" - echo "2. Load data and create AI Foundry agents:" + echo "2. Load data and create Azure AI Foundry agents:" echo "" echo " Option A - Run both stages at once (recommended):" echo " bash ./infra/scripts/post-provision/postprovision_data_agents.sh" diff --git a/chat-app/backend/.dockerignore b/chat-app/backend/.dockerignore new file mode 100644 index 00000000..70327c97 --- /dev/null +++ b/chat-app/backend/.dockerignore @@ -0,0 +1,10 @@ +.env +.env.* +!.env.example +__pycache__ +*.pyc +.venv +venv +.pytest_cache +.mypy_cache +*.md diff --git a/chat-app/backend/README.md b/chat-app/backend/README.md index 31615f64..4ad74761 100644 --- a/chat-app/backend/README.md +++ b/chat-app/backend/README.md @@ -7,7 +7,7 @@ AI-powered chat application backend built with FastAPI, designed to integrate wi - **Multiple AI Agents**: Customer support, sales assistant, and technical support agents - **Conversation Management**: Create, manage, and track chat conversations - **Streaming Responses**: Real-time AI responses with Server-Sent Events -- **Azure AI Integration**: Connects to Azure OpenAI and AI Search for enhanced capabilities +- **Azure AI Integration**: Connects to Azure OpenAI and Azure AI Search for enhanced capabilities - **Session-based Authentication**: Guest user sessions for development - **Flexible Storage**: In-memory storage for development, Azure Cosmos DB for production @@ -167,12 +167,12 @@ flake8 app/ ### Data Service - **In-Memory**: Fast development storage -- **Cosmos DB**: Production-ready document storage +- **Azure Cosmos DB**: Production-ready document storage - **Session Management**: Guest user sessions with conversation tracking ### Authentication - Session-based authentication for guest users -- Extensible for Azure AD integration +- Extensible for Microsoft Entra ID integration - Per-session conversation isolation ## Deployment diff --git a/chat-app/backend/app/agent_instructions.py b/chat-app/backend/app/agent_instructions.py index 9cb21f30..72794111 100644 --- a/chat-app/backend/app/agent_instructions.py +++ b/chat-app/backend/app/agent_instructions.py @@ -74,7 +74,7 @@ - Be overly salesy or pushy Available Tools: -- search(query, limit) - Search products with hybrid AI Search + Cosmos DB +- search(query, limit) - Search products with hybrid Azure AI Search + Azure Cosmos DB - search_fast(query, limit) - Ultra-fast product search for quick responses - get_by_id(product_id) - Get specific product by ID - get_by_category(category, limit) - Get products in a specific category @@ -163,7 +163,7 @@ - Provide wrong contact information Available Tools: -- lookup(query, top) - Search policy documents with enhanced AI Search +- lookup(query, top) - Search policy documents with enhanced Azure AI Search - lookup_policy(query, context) - Context-aware policy lookup - get_return_policy() - Get return policy information - get_shipping_info() - Get shipping information diff --git a/chat-app/backend/app/cosmos_service.py b/chat-app/backend/app/cosmos_service.py index 66f7bf27..db21eb50 100644 --- a/chat-app/backend/app/cosmos_service.py +++ b/chat-app/backend/app/cosmos_service.py @@ -66,7 +66,7 @@ def _prepare_query_parameters(params: List[Dict[str, Any]]) -> List[Dict[str, ob class CosmosDatabaseService(DatabaseService): - """Cosmos DB implementation of the database service""" + """Azure Cosmos DB implementation of the database service""" def __init__(self): # Type annotations for instance variables @@ -78,14 +78,14 @@ def __init__(self): self.cart_container: ContainerProxy self.transactions_container: ContainerProxy - # Use Azure credential authentication for AAD-enabled Cosmos DB + # Use Azure credential authentication for AAD-enabled Azure Cosmos DB try: # Ensure we have the endpoint if not settings.cosmos_db_endpoint: - raise Exception("Cosmos DB endpoint is required") + raise Exception("Azure Cosmos DB endpoint is required") logger.info( - "Attempting to authenticate to Cosmos DB with Azure credentials..." + "Attempting to authenticate to Azure Cosmos DB with Azure credentials..." ) # Use the centralized credential utility that handles dev vs prod environments @@ -108,11 +108,11 @@ def __init__(self): if "RBAC permissions" in error_msg or "principal" in error_msg: raise Exception( f""" -❌ RBAC Permission Error: Your service principal lacks Cosmos DB permissions. +❌ RBAC Permission Error: Your service principal lacks Azure Cosmos DB permissions. To fix this, run these Azure CLI commands: -1. Assign Cosmos DB Data Contributor role: +1. Assign Azure Cosmos DB Data Contributor role: az cosmosdb sql role assignment create \\ --account-name ecommerce-prod-cosmos-202510211322 \\ --resource-group [YOUR_RESOURCE_GROUP] \\ @@ -134,11 +134,11 @@ def __init__(self): if "Local Authorization is disabled" in error_msg: raise Exception( f""" -❌ Authentication Error: This Cosmos DB requires AAD authentication and your credentials don't have proper permissions. +❌ Authentication Error: This Azure Cosmos DB requires AAD authentication and your credentials don't have proper permissions. Solutions: 1. Grant RBAC permissions (see commands above) -2. Ask your Azure admin to assign "Cosmos DB Built-in Data Contributor" role +2. Ask your Microsoft Entra ID admin to assign "Azure Cosmos DB Built-in Data Contributor" role 3. Or temporarily enable local auth: az cosmosdb update --name ecommerce-prod-cosmos-202510211322 --resource-group [RESOURCE_GROUP] --disable-key-based-metadata-write-access false Original error: {error_msg} @@ -147,7 +147,7 @@ def __init__(self): # Generic authentication error raise Exception( - f"Cannot authenticate to Cosmos DB with Azure credentials. Check your Azure login and permissions. Error: {error_msg}" + f"Cannot authenticate to Azure Cosmos DB with Azure credentials. Check your Azure login and permissions. Error: {error_msg}" ) self.database = self.client.get_database_client( @@ -156,7 +156,7 @@ def __init__(self): self._initialize_containers() def _serialize_datetime_fields(self, data: dict) -> dict: - """Convert datetime objects to ISO format for Cosmos DB serialization""" + """Convert datetime objects to ISO format for Azure Cosmos DB serialization""" serialized_data = data.copy() for key, value in serialized_data.items(): if isinstance(value, datetime): @@ -182,7 +182,7 @@ def _deserialize_datetime_fields(self, data: dict) -> dict: return deserialized_data def _initialize_containers(self): - """Initialize Cosmos DB containers""" + """Initialize Azure Cosmos DB containers""" try: # Create database if it doesn't exist self.database = self.client.create_database_if_not_exists( @@ -220,10 +220,10 @@ def _initialize_containers(self): offer_throughput=400, ) - logger.info("Cosmos DB containers initialized successfully") + logger.info("Azure Cosmos DB containers initialized successfully") except Exception as e: - logger.error(f"Error initializing Cosmos DB containers: {str(e)}") + logger.error(f"Error initializing Azure Cosmos DB containers: {str(e)}") raise async def get_products( @@ -324,11 +324,11 @@ async def get_products( return products except Exception as e: - logger.error(f"Error fetching products from Cosmos DB: {str(e)}") + logger.error(f"Error fetching products from Azure Cosmos DB: {str(e)}") raise async def get_product(self, product_id: str) -> Optional[Product]: - """Get a single product by ID - optimized for Cosmos DB""" + """Get a single product by ID - optimized for Azure Cosmos DB""" try: # Use direct read for better performance (if we know the partition key) # For now, use cross-partition query since products might be in different partitions @@ -352,7 +352,7 @@ async def get_product(self, product_id: str) -> Optional[Product]: item[field].replace("Z", "+00:00") ) - # Map Cosmos DB fields to Product model fields + # Map Azure Cosmos DB fields to Product model fields product = Product( id=item.get("id"), title=item.get("title", ""), @@ -373,7 +373,7 @@ async def get_product(self, product_id: str) -> Optional[Product]: return None except Exception as e: - logger.error(f"Error fetching product from Cosmos DB: {str(e)}") + logger.error(f"Error fetching product from Azure Cosmos DB: {str(e)}") raise async def create_product(self, product: ProductCreate) -> Product: @@ -381,13 +381,13 @@ async def create_product(self, product: ProductCreate) -> Product: try: new_product = Product(id=str(uuid.uuid4()), **product.model_dump()) - # Serialize datetime fields for Cosmos DB + # Serialize datetime fields for Azure Cosmos DB product_dict = self._serialize_datetime_fields(new_product.model_dump()) self.products_container.create_item(product_dict) # type: ignore return new_product except Exception as e: - logger.error(f"Error creating product in Cosmos DB: {str(e)}") + logger.error(f"Error creating product in Azure Cosmos DB: {str(e)}") raise async def update_product( @@ -407,7 +407,7 @@ async def update_product( existing_product.updated_at = datetime.utcnow() - # Replace in Cosmos DB - serialize datetime fields + # Replace in Azure Cosmos DB - serialize datetime fields product_dict = self._serialize_datetime_fields( existing_product.model_dump() ) @@ -418,7 +418,7 @@ async def update_product( return existing_product except Exception as e: - logger.error(f"Error updating product in Cosmos DB: {str(e)}") + logger.error(f"Error updating product in Azure Cosmos DB: {str(e)}") raise async def delete_product(self, product_id: str) -> bool: @@ -437,7 +437,7 @@ async def delete_product(self, product_id: str) -> bool: return True except Exception as e: - logger.error(f"Error deleting product from Cosmos DB: {str(e)}") + logger.error(f"Error deleting product from Azure Cosmos DB: {str(e)}") raise async def get_product_by_sku(self, sku: str) -> Optional[Product]: @@ -488,7 +488,7 @@ async def search_products(self, query: str, limit: int = 10) -> List[Product]: async def search_products_hybrid( self, query: str, limit: int = 10 ) -> List[Product]: - """Hybrid search: Azure AI Search first (fast), then Cosmos DB fallback""" + """Hybrid search: Azure AI Search first (fast), then Azure Cosmos DB fallback""" try: # Strategy 1: Try Azure AI Search first (fastest, most accurate) try: @@ -501,16 +501,16 @@ async def search_products_hybrid( f"Azure AI Search returned {len(ai_search_results)} products for query: {query}" ) - # Convert AI Search results to Product objects + # Convert Azure AI Search results to Product objects products = [] for hit in ai_search_results: - # Try to get full product data from Cosmos DB + # Try to get full product data from Azure Cosmos DB try: full_product = await self.get_product_by_sku(hit["id"]) if full_product: products.append(full_product) else: - # Create Product from AI Search data + # Create Product from Azure AI Search data product = Product( id=hit["id"], title=hit.get("title", ""), @@ -534,21 +534,21 @@ async def search_products_hybrid( if products: logger.info( - f"Hybrid search (AI Search) returned {len(products)} products" + f"Hybrid search (Azure AI Search) returned {len(products)} products" ) return products[:limit] except ImportError: logger.warning( - "Azure AI Search not available, falling back to Cosmos DB" + "Azure AI Search not available, falling back to Azure Cosmos DB" ) except Exception as e: logger.warning( - f"Azure AI Search failed: {e}, falling back to Cosmos DB" + f"Azure AI Search failed: {e}, falling back to Azure Cosmos DB" ) - # Strategy 2: Fallback to enhanced Cosmos DB search - logger.info(f"Falling back to enhanced Cosmos DB search for query: {query}") + # Strategy 2: Fallback to enhanced Azure Cosmos DB search + logger.info(f"Falling back to enhanced Azure Cosmos DB search for query: {query}") return await self.search_products_enhanced(query, limit) except Exception as e: @@ -568,16 +568,16 @@ async def search_products_ai_search( if not ai_search_results: return [] - # Convert AI Search results to Product objects + # Convert Azure AI Search results to Product objects products = [] for hit in ai_search_results: try: - # Try to get full product data from Cosmos DB + # Try to get full product data from Azure Cosmos DB full_product = await self.get_product_by_sku(hit["id"]) if full_product: products.append(full_product) else: - # Create Product from AI Search data + # Create Product from Azure AI Search data product = Product( id=hit["id"], title=hit.get("title", ""), @@ -595,17 +595,17 @@ async def search_products_ai_search( products.append(product) except Exception as e: logger.warning( - f"Failed to process AI Search result {hit['id']}: {e}" + f"Failed to process Azure AI Search result {hit['id']}: {e}" ) continue logger.info( - f"AI Search returned {len(products)} products for query: {query}" + f"Azure AI Search returned {len(products)} products for query: {query}" ) return products[:limit] except Exception as e: - logger.error(f"AI Search error: {e}") + logger.error(f"Azure AI Search error: {e}") return [] async def search_products_enhanced( @@ -878,14 +878,14 @@ async def create_user(self, user: UserCreate) -> User: try: new_user = User(id=str(uuid.uuid4()), email=user.email, name=user.name) - # Convert datetime objects to ISO format for Cosmos DB + # Convert datetime objects to ISO format for Azure Cosmos DB user_dict = self._serialize_datetime_fields(new_user.model_dump()) self.users_container.create_item(user_dict) # type: ignore return new_user except Exception as e: - logger.error(f"Error creating user in Cosmos DB: {str(e)}") + logger.error(f"Error creating user in Azure Cosmos DB: {str(e)}") raise async def get_user_by_id(self, user_id: str) -> Optional[User]: @@ -924,7 +924,7 @@ async def get_user_by_id(self, user_id: str) -> Optional[User]: raise async def get_user_by_email(self, email: str) -> Optional[User]: - """Get user by email - optimized for Cosmos DB""" + """Get user by email - optimized for Azure Cosmos DB""" try: # Use a simple, efficient query query = "SELECT * FROM c WHERE c.email = @email" @@ -960,7 +960,7 @@ async def get_user_by_email(self, email: str) -> Optional[User]: async def create_user_with_password( self, email: str, name: str, password: str, user_id: Optional[str] = None ) -> User: - """Create a new user - simplified for Cosmos DB""" + """Create a new user - simplified for Azure Cosmos DB""" try: # Use provided user_id (from Easy Auth) or generate UUID new_user = User(id=user_id or str(uuid.uuid4()), email=email, name=name) @@ -975,7 +975,7 @@ async def create_user_with_password( else: user_dict[field] = dt.isoformat() - # Create in Cosmos DB using user ID as partition key + # Create in Azure Cosmos DB using user ID as partition key self.users_container.create_item(user_dict) # type: ignore return new_user @@ -984,7 +984,7 @@ async def create_user_with_password( raise async def update_user(self, user_id: str, user: UserUpdate) -> Optional[User]: - """Update user - simplified for Cosmos DB""" + """Update user - simplified for Azure Cosmos DB""" try: # Get existing user existing_user = await self.get_user(user_id) @@ -1008,7 +1008,7 @@ async def update_user(self, user_id: str, user: UserUpdate) -> Optional[User]: else: user_dict[field] = dt.isoformat() - # Replace in Cosmos DB + # Replace in Azure Cosmos DB self.users_container.replace_item( # type: ignore item=user_id, body=user_dict ) @@ -1063,7 +1063,7 @@ async def get_chat_session( return ChatSession(**session_data) except Exception as e: - logger.error(f"Error fetching chat session from Cosmos DB: {str(e)}") + logger.error(f"Error fetching chat session from Azure Cosmos DB: {str(e)}") raise async def get_chat_sessions_by_user(self, user_id: str) -> List[ChatSession]: @@ -1103,7 +1103,7 @@ async def get_chat_sessions_by_user(self, user_id: str) -> List[ChatSession]: return sessions except Exception as e: - logger.error(f"Error fetching chat sessions from Cosmos DB: {str(e)}") + logger.error(f"Error fetching chat sessions from Azure Cosmos DB: {str(e)}") raise async def create_chat_session(self, session: ChatSessionCreate) -> ChatSession: @@ -1137,7 +1137,7 @@ async def create_chat_session(self, session: ChatSessionCreate) -> ChatSession: return new_session except Exception as e: - logger.error(f"Error creating chat session in Cosmos DB: {str(e)}") + logger.error(f"Error creating chat session in Azure Cosmos DB: {str(e)}") raise async def add_message_to_session( @@ -1215,7 +1215,7 @@ async def add_message_to_session( if "created_at" in msg and isinstance(msg["created_at"], datetime): msg["created_at"] = msg["created_at"].isoformat() - # Update session in Cosmos DB + # Update session in Azure Cosmos DB self.chat_container.upsert_item(session_dict) # type: ignore # Return the updated session (re-fetch to ensure consistency) @@ -1225,7 +1225,7 @@ async def add_message_to_session( return updated_session except Exception as e: - logger.error(f"Error adding message to chat session in Cosmos DB: {str(e)}") + logger.error(f"Error adding message to chat session in Azure Cosmos DB: {str(e)}") raise async def update_chat_session( @@ -1261,13 +1261,13 @@ async def update_chat_session( if "created_at" in msg and isinstance(msg["created_at"], datetime): msg["created_at"] = msg["created_at"].isoformat() - # Update in Cosmos DB + # Update in Azure Cosmos DB self.chat_container.upsert_item(session_dict) # type: ignore return session except Exception as e: - logger.error(f"Error updating chat session in Cosmos DB: {str(e)}") + logger.error(f"Error updating chat session in Azure Cosmos DB: {str(e)}") raise async def delete_chat_session( @@ -1291,7 +1291,7 @@ async def delete_chat_session( return True except Exception as e: - logger.error(f"Error deleting chat session from Cosmos DB: {str(e)}") + logger.error(f"Error deleting chat session from Azure Cosmos DB: {str(e)}") raise async def get_cart(self, user_id: str) -> Optional[Cart]: @@ -1331,11 +1331,11 @@ async def get_cart(self, user_id: str) -> Optional[Cart]: return Cart(**cart_data) except Exception as e: - logger.error(f"Error fetching cart from Cosmos DB: {str(e)}") + logger.error(f"Error fetching cart from Azure Cosmos DB: {str(e)}") raise async def update_cart(self, user_id: str, cart: Cart) -> Cart: - """Update user's cart - optimized for Cosmos DB""" + """Update user's cart - optimized for Azure Cosmos DB""" try: # Set the cart ID to user_id for direct access cart.id = user_id @@ -1366,7 +1366,7 @@ async def update_cart(self, user_id: str, cart: Cart) -> Cart: return cart except Exception as e: - logger.error(f"Error updating cart in Cosmos DB: {str(e)}") + logger.error(f"Error updating cart in Azure Cosmos DB: {str(e)}") raise async def create_transaction( @@ -1396,7 +1396,7 @@ async def create_transaction( + new_transaction.shipping ) - # Serialize datetime fields for Cosmos DB + # Serialize datetime fields for Azure Cosmos DB transaction_dict = self._serialize_datetime_fields( new_transaction.model_dump() ) @@ -1405,7 +1405,7 @@ async def create_transaction( return new_transaction except Exception as e: - logger.error(f"Error creating transaction in Cosmos DB: {str(e)}") + logger.error(f"Error creating transaction in Azure Cosmos DB: {str(e)}") raise # Additional methods required by DatabaseService interface diff --git a/chat-app/backend/app/create_assistants.py b/chat-app/backend/app/create_assistants.py index 55606964..e1ef648f 100644 --- a/chat-app/backend/app/create_assistants.py +++ b/chat-app/backend/app/create_assistants.py @@ -21,8 +21,8 @@ async def create_assistants(): await init_foundry_client() client = get_foundry_client() - # Get OpenAI client - print("Getting OpenAI client...") + # Get Azure OpenAI client + print("Getting Azure OpenAI client...") openai_client = await client.get_openai_client( # type: ignore api_version=settings.azure_openai_api_version ) diff --git a/chat-app/backend/app/database.py b/chat-app/backend/app/database.py index 23889060..a0a99df3 100644 --- a/chat-app/backend/app/database.py +++ b/chat-app/backend/app/database.py @@ -102,12 +102,12 @@ def get_database_service() -> DatabaseService: return CosmosDatabaseService() except Exception as e: raise RuntimeError( - f"Cannot connect to Cosmos DB: {e}. Please check your COSMOS_DB_ENDPOINT configuration." + f"Cannot connect to Azure Cosmos DB: {e}. Please check your COSMOS_DB_ENDPOINT configuration." ) - # No fallback - raise error if Cosmos DB config is missing + # No fallback - raise error if Azure Cosmos DB config is missing raise RuntimeError( - "Cosmos DB is not configured. Please set COSMOS_DB_ENDPOINT environment variable." + "Azure Cosmos DB is not configured. Please set COSMOS_DB_ENDPOINT environment variable." ) diff --git a/chat-app/backend/app/list_assistants.py b/chat-app/backend/app/list_assistants.py index a7b62fcc..b7e83440 100644 --- a/chat-app/backend/app/list_assistants.py +++ b/chat-app/backend/app/list_assistants.py @@ -20,8 +20,8 @@ async def list_assistants(): await init_foundry_client() client = get_foundry_client() - # Get OpenAI client - print("Getting OpenAI client...") + # Get Azure OpenAI client + print("Getting Azure OpenAI client...") from config import settings openai_client = await client.get_openai_client( # type: ignore diff --git a/chat-app/backend/app/plugins/orders_plugin.py b/chat-app/backend/app/plugins/orders_plugin.py index dc563412..02006d51 100644 --- a/chat-app/backend/app/plugins/orders_plugin.py +++ b/chat-app/backend/app/plugins/orders_plugin.py @@ -24,7 +24,7 @@ def run_async_sync(coro): class OrdersPlugin: - """Plugin for order management using Cosmos DB""" + """Plugin for order management using Azure Cosmos DB""" @kernel_function(description="Get order by ID and return JSON") def get_order(self, order_id: str) -> str: diff --git a/chat-app/backend/app/routers/auth.py b/chat-app/backend/app/routers/auth.py index e861832d..efae378f 100644 --- a/chat-app/backend/app/routers/auth.py +++ b/chat-app/backend/app/routers/auth.py @@ -62,7 +62,7 @@ async def get_current_user_info(request: Request): # Additional logging for user creation process if not current_user.get("is_guest"): logger.info( - "πŸ” /api/auth/me: Authenticated user detected - will check/create in Cosmos DB" + "πŸ” /api/auth/me: Authenticated user detected - will check/create in Azure Cosmos DB" ) if current_user.get("is_guest"): @@ -131,7 +131,7 @@ async def get_current_user_info(request: Request): email=email, name=name, password="", - user_id=user_id, # Use Easy Auth user_principal_id as Cosmos DB user ID + user_id=user_id, # Use Easy Auth user_principal_id as Azure Cosmos DB user ID ) logger.info(f"Created new user: {user.email}") track_event_if_configured("Auth_User_Created", {"user_id": user_id, "email": email}) diff --git a/chat-app/backend/app/routers/chat.py b/chat-app/backend/app/routers/chat.py index 06111351..65a62226 100644 --- a/chat-app/backend/app/routers/chat.py +++ b/chat-app/backend/app/routers/chat.py @@ -299,7 +299,7 @@ async def save_voice_message( message: ChatMessageCreate, current_user: Optional[Dict[str, Any]] = Depends(get_current_user_optional), ): - """Save a voice message to Cosmos DB without triggering Foundry agents.""" + """Save a voice message to Azure Cosmos DB without triggering Foundry agents.""" try: user_id = current_user.get("user_id") if current_user else None session_id = getattr(message, "session_id", None) diff --git a/chat-app/backend/app/simple_foundry_orchestrator.py b/chat-app/backend/app/simple_foundry_orchestrator.py index 8126f33c..864a05c4 100644 --- a/chat-app/backend/app/simple_foundry_orchestrator.py +++ b/chat-app/backend/app/simple_foundry_orchestrator.py @@ -86,7 +86,7 @@ async def _build_foundry_agent( client = get_foundry_client() try: - # Get the OpenAI client from Foundry with proper API version + # Get the Azure OpenAI client from Foundry with proper API version openai_client = await client.get_openai_client( # type: ignore api_version=settings.azure_openai_api_version ) @@ -97,7 +97,7 @@ async def _build_foundry_agent( f"βœ… Successfully connected to Foundry assistant: {assistant.name or name}" ) - # Create a custom agent that uses the OpenAI client directly + # Create a custom agent that uses the Azure OpenAI client directly class FoundryAgent: def __init__(self, assistant_id: str, name: str, openai_client): self.id = assistant_id diff --git a/chat-app/backend/app/utils/voice_utils.py b/chat-app/backend/app/utils/voice_utils.py index 196d68db..f5e471c1 100644 --- a/chat-app/backend/app/utils/voice_utils.py +++ b/chat-app/backend/app/utils/voice_utils.py @@ -9,7 +9,7 @@ from .azure_credential_utils import get_azure_credential_async -# OpenAI realtime voice names (passed as plain strings, not AzureStandardVoice) +# Azure OpenAI realtime voice names (passed as plain strings, not AzureStandardVoice) REALTIME_VOICES = frozenset({ "alloy", "ash", "ballad", "coral", "echo", "sage", "shimmer", "verse", }) diff --git a/chat-app/frontend/LOCAL_AUTH_SETUP.md b/chat-app/frontend/LOCAL_AUTH_SETUP.md index 25d5b6e4..de5861da 100644 --- a/chat-app/frontend/LOCAL_AUTH_SETUP.md +++ b/chat-app/frontend/LOCAL_AUTH_SETUP.md @@ -39,7 +39,7 @@ AZURE_CLIENT_SECRET=your-client-secret ### 3. Azure App Registration 1. Go to [Azure Portal](https://portal.azure.com) -2. Navigate to "Azure Active Directory" > "App registrations" +2. Navigate to "Microsoft Entra ID" > "App registrations" 3. Click "New registration" 4. Fill in: - Name: "E-commerce Chat Local Dev" diff --git a/chat-app/frontend/src/lib/api.ts b/chat-app/frontend/src/lib/api.ts index 3aa7b85a..7513d234 100644 --- a/chat-app/frontend/src/lib/api.ts +++ b/chat-app/frontend/src/lib/api.ts @@ -1,5 +1,5 @@ -import axios from 'axios'; import { mapApiChatMessage } from '@/lib/chatMessageUtils'; +import axios from 'axios'; let widgetApiBaseOverride: string | null = null; @@ -246,7 +246,7 @@ export const getChatConfig = async (): Promise => { return response.data as ChatConfig; }; -/** Save a voice message to the chat session (Cosmos DB) without triggering Foundry agents. */ +/** Save a voice message to the chat session (Azure Cosmos DB) without triggering Foundry agents. */ export const saveVoiceMessage = async ( sessionId: string, content: string, diff --git a/documents/AVMPostDeploymentGuide.md b/documents/AVMPostDeploymentGuide.md index 2c53f71a..0f35b3ae 100644 --- a/documents/AVMPostDeploymentGuide.md +++ b/documents/AVMPostDeploymentGuide.md @@ -100,7 +100,7 @@ This script will: - Create and configure Azure AI Search indexes - Populate search indexes with product and policy documents -**Step 2: Create AI Foundry Agents** +**Step 2: Create Azure AI Foundry Agents** Run the agent creation script to set up specialized AI agents: diff --git a/documents/AppAuthentication.md b/documents/AppAuthentication.md index a97bb8f7..01c606ec 100644 --- a/documents/AppAuthentication.md +++ b/documents/AppAuthentication.md @@ -21,7 +21,7 @@ This document provides step-by-step instructions to configure Azure App Registra ![Add Provider](Images/AppAuthIdentityProvider.png) -4. Select the first option `Microsoft Entra Id` from the drop-down list and select `client secret expiration` under App registration. +4. Select the first option `Microsoft Entra ID` from the drop-down list and select `client secret expiration` under App registration. > NOTE: If `Create new app registration` is disabled, then go to [Create new app registration](./CreateNewAppRegistration.md) and come back to this step to complete the app authentication. ![Add Provider](Images/AppAuthIdentityProviderAdd.png) diff --git a/documents/DeploymentGuide.md b/documents/DeploymentGuide.md index f232eccb..5ecc0ebc 100644 --- a/documents/DeploymentGuide.md +++ b/documents/DeploymentGuide.md @@ -19,7 +19,7 @@ Ensure you have access to an [Azure subscription](https://azure.microsoft.com/fr | **Contributor** | Subscription level | Create and manage Azure resources | | **User Access Administrator** | Subscription level | Manage user access and role assignments | | **Role Based Access Control Admin** | Subscription/Resource Group level | Configure RBAC permissions | -| **App Registration Creation** | Azure Active Directory | Create and configure authentication | +| **App Registration Creation** | Microsoft Entra ID | Create and configure authentication | **πŸ” How to Check Your Permissions:** @@ -127,7 +127,7 @@ Select one of the following options to deploy the Customer Chatbot Solution Acce 2. Sign in with your Azure account when prompted 3. Select the subscription where you want to deploy the solution 4. Wait for the environment to initialize (includes all deployment tools) -5. Once the solution opens, the **AI Foundry terminal** will automatically start running the following command to install the required dependencies: +5. Once the solution opens, the **Azure AI Foundry terminal** will automatically start running the following command to install the required dependencies: ```shell sh install.sh @@ -275,7 +275,7 @@ To optimize costs and integrate with your existing Azure infrastructure, you can - **Log Analytics Workspace:** Integrate with your existing monitoring infrastructure by reusing an established Log Analytics workspace for centralized logging and monitoring. [Configuration Guide](./ReuseLogAnalytics.md) -- **Azure AI Foundry Project:** Leverage your existing AI Foundry project and deployed models to avoid duplication and reduce provisioning time. [Configuration Guide](./ReuseFoundryProject.md) +- **Azure AI Foundry Project:** Leverage your existing Azure AI Foundry project and deployed models to avoid duplication and reduce provisioning time. [Configuration Guide](./ReuseFoundryProject.md) **Key Benefits:** - **Cost Optimization:** Eliminate duplicate resource charges @@ -417,7 +417,7 @@ This script will: > **Tip:** Pass `-ImageTag ` (PowerShell) or `--image-tag ` (bash) to publish a specific tag. Pass `-ShowLogs` / `--show-logs` to stream the full build output. Each run generates a fresh timestamp tag by default. -**Step 2: Load Data and Create AI Foundry Agents** +**Step 2: Load Data and Create Azure AI Foundry Agents** #### Option A β€” Run both stages at once (recommended) @@ -452,7 +452,7 @@ This stage: - Creates and configures Azure AI Search indexes - Populates search indexes with product and policy documents -**Stage 2: Create AI Foundry Agents** +**Stage 2: Create Azure AI Foundry Agents** - **For PowerShell (Windows/Linux/macOS):** ```shell diff --git a/documents/LocalDevelopmentSetup.md b/documents/LocalDevelopmentSetup.md index 9b53aa92..a00291ea 100644 --- a/documents/LocalDevelopmentSetup.md +++ b/documents/LocalDevelopmentSetup.md @@ -143,7 +143,7 @@ az account show ## Step 4: Deploy Azure Resources -The backends talk to real Azure services (AI Foundry, OpenAI, AI Search, Cosmos DB). Provision them first: +The backends talk to real Azure services (Azure AI Foundry, Azure OpenAI, Azure AI Search, Azure Cosmos DB). Provision them first: ```bash azd auth login @@ -152,7 +152,7 @@ azd up πŸ“– See the [Deployment Guide](./DeploymentGuide.md) for the full deployment flow (including scenario selection and post-provision data/agent scripts). -After `azd up` completes, run the post-provision data upload and agent creation scripts described in the Deployment Guide β€” the backends need the AI Foundry agent names in order to serve requests. +After `azd up` completes, run the post-provision data upload and agent creation scripts described in the Deployment Guide β€” the backends need the Azure AI Foundry agent names in order to serve requests. --- @@ -179,7 +179,7 @@ Populate the file with the endpoints/keys from your provisioned resources. Minim APP_ENV=dev ALLOWED_ORIGINS_STR=http://localhost:3001,http://localhost:5173 -# Azure AI Foundry / OpenAI +# Azure AI Foundry / Azure OpenAI AZURE_AI_AGENT_ENDPOINT=https://.services.ai.azure.com/api/projects/ AZURE_OPENAI_ENDPOINT=https://.openai.azure.com/ AZURE_OPENAI_API_VERSION=2025-01-01-preview @@ -212,7 +212,7 @@ cp scenario-app/backend/env.sample scenario-app/backend/.env Copy-Item scenario-app/backend/env.sample scenario-app/backend/.env ``` -The scenario backend needs Cosmos + OpenAI (and Application Insights, optionally). Fill in the same Azure endpoints as above. +The scenario backend needs Cosmos + Azure OpenAI (and Application Insights, optionally). Fill in the same Azure endpoints as above. > **Port note:** Both backends default to port `8000`. For local dev, run the chat backend on `8001` (matches its Dockerfile) so the two do not collide. See Step 6. @@ -243,7 +243,7 @@ If the post-provision hook already assigned roles, skip this. Otherwise grant yo ```bash PRINCIPAL_ID=$(az ad signed-in-user show --query id -o tsv) -# Cosmos DB data plane access +# Azure Cosmos DB data plane access az cosmosdb sql role assignment create \ --account-name \ --resource-group \ @@ -251,7 +251,7 @@ az cosmosdb sql role assignment create \ --principal-id "$PRINCIPAL_ID" \ --scope "/" -# AI Search data plane access +# Azure AI Search data plane access az role assignment create \ --assignee "$PRINCIPAL_ID" \ --role "Search Index Data Contributor" \ diff --git a/documents/TechnicalArchitecture.md b/documents/TechnicalArchitecture.md index b7e85318..2aad7029 100644 --- a/documents/TechnicalArchitecture.md +++ b/documents/TechnicalArchitecture.md @@ -11,7 +11,7 @@ Orchestrates multi-agent workflows with an intelligent orchestrator agent that u - **Product Lookup Agent**: Searches product catalogs using Azure AI Search to help customers discover products through natural language queries and provide personalized recommendations - **Policy/Knowledge Agent**: Retrieves information from policy documents and knowledge bases to answer customer support questions about warranties, returns, and company policies -### Azure OpenAI Service +### Azure OpenAI Service Provides large language model (LLM) capabilities using GPT-5.4-mini to power natural language understanding and conversational responses across all AI agents. ### Azure AI Search diff --git a/documents/TroubleShootingSteps.md b/documents/TroubleShootingSteps.md index 9c2346a3..ee79204d 100644 --- a/documents/TroubleShootingSteps.md +++ b/documents/TroubleShootingSteps.md @@ -46,9 +46,9 @@ Use these as quick reference guides to unblock your deployments. | **ReadOnlyDisabledSubscription** | Subscription is disabled or in read-only state |
  • Check if you have an active subscription before starting the deployment
  • Depending on the type of the Azure Subscription, the expiration date might have been reached
  • You have to activate the Azure Subscription before creating any Azure resource
  • Refer to [Reactivate a disabled Azure subscription](https://learn.microsoft.com/en-us/azure/cost-management-billing/manage/subscription-disabled) documentation
| | **MissingSubscriptionRegistration/
AllowBringYourOwnPublicIpAddress** | Required feature not registered in subscription | **Enable `AllowBringYourOwnPublicIpAddress` Feature**

Before deploying the resources, you may need to enable the **Bring Your Own Public IP Address** feature in Azure. This is required only once per subscription.

**Steps:**
  • Run the following command to register the feature:
    `az feature register --namespace Microsoft.Network --name AllowBringYourOwnPublicIpAddress`
  • Wait for the registration to complete. Check the status using:
    `az feature show --namespace Microsoft.Network --name AllowBringYourOwnPublicIpAddress --query properties.state`
  • The output should show: "Registered"
  • Once the feature is registered, refresh the provider:
    `az provider register --namespace Microsoft.Network`
πŸ’‘ Note: Feature registration may take several minutes to complete. This needs to be done only once per Azure subscription. | | **Unauthorized - Operation cannot be completed without additional quota** | Insufficient quota for requested operation |
  • Check your quota usage using:
    `az vm list-usage --location "" -o table`
  • To request more quota refer to [VM Quota Request](https://techcommunity.microsoft.com/blog/startupsatmicrosoftblog/how-to-increase-quota-for-specific-types-of-azure-virtual-machines/3792394)
| -| **CrossTenantDeploymentNotPermitted** | Deployment across different Azure AD tenants not allowed |
  • **Check tenant match:** Ensure your deployment identity (user/SP) and the target resource group are in the same tenant:
    `az account show`
    `az group show --name `
  • **Verify pipeline/service principal:** If using CI/CD, confirm the service principal belongs to the same tenant and has permissions on the resource group
  • **Avoid cross-tenant references:** Make sure your Bicep doesn't reference subscriptions, resource groups, or resources in another tenant
  • **Test minimal deployment:** Deploy a simple resource to the same resource group to confirm identity and tenant are correct
  • **Guest/external accounts:** Avoid using guest users from other tenants; use native accounts or SPs in the tenant
| +| **CrossTenantDeploymentNotPermitted** | Deployment across different Microsoft Entra ID tenants not allowed |
  • **Check tenant match:** Ensure your deployment identity (user/SP) and the target resource group are in the same tenant:
    `az account show`
    `az group show --name `
  • **Verify pipeline/service principal:** If using CI/CD, confirm the service principal belongs to the same tenant and has permissions on the resource group
  • **Avoid cross-tenant references:** Make sure your Bicep doesn't reference subscriptions, resource groups, or resources in another tenant
  • **Test minimal deployment:** Deploy a simple resource to the same resource group to confirm identity and tenant are correct
  • **Guest/external accounts:** Avoid using guest users from other tenants; use native accounts or SPs in the tenant
| | **RequestDisallowedByPolicy** | Azure Policy blocking the requested operation |
  • This typically indicates that an Azure Policy is preventing the requested action due to policy restrictions in your subscription
  • For more details and guidance on resolving this issue, refer to: [RequestDisallowedByPolicy](https://learn.microsoft.com/en-us/troubleshoot/azure/azure-kubernetes/create-upgrade-delete/error-code-requestdisallowedbypolicy)
| -| **SpecialFeatureOrQuotaIdRequired** | Subscription lacks access to specific Azure OpenAI models | This error occurs when your subscription does not have access to certain Azure OpenAI models.

**Example error message:**
`SpecialFeatureOrQuotaIdRequired: The current subscription does not have access to this model 'Format:OpenAI,Name:o3,Version:2025-04-16'.`

**Resolution:**
To gain access, submit a request using the official form:
πŸ‘‰ [Azure OpenAI Model Access Request](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR7en2Ais5pxKtso_Pz4b1_xUQ1VGQUEzRlBIMVU2UFlHSFpSNkpOR0paRSQlQCN0PWcu)

You'll need to use this form if you require access to the following restricted models:
  • gpt-5
  • o3
  • o3-pro
  • deep research
  • reasoning summary
  • gpt-image-1
Once your request is approved, redeploy your resource. | +| **SpecialFeatureOrQuotaIdRequired** | Subscription lacks access to specific Azure OpenAI models | This error occurs when your subscription does not have access to certain Azure OpenAI models.

**Example error message:**
`SpecialFeatureOrQuotaIdRequired: The current subscription does not have access to this model 'Format:Azure OpenAI,Name:o3,Version:2025-04-16'.`

**Resolution:**
To gain access, submit a request using the official form:
πŸ‘‰ [Azure OpenAI Model Access Request](https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=v4j5cvGGr0GRqy180BHbR7en2Ais5pxKtso_Pz4b1_xUQ1VGQUEzRlBIMVU2UFlHSFpSNkpOR0paRSQlQCN0PWcu)

You'll need to use this form if you require access to the following restricted models:
  • gpt-5
  • o3
  • o3-pro
  • deep research
  • reasoning summary
  • gpt-image-1
Once your request is approved, redeploy your resource. | | **ResourceProviderError** | Resource provider not registered in subscription |
  • This error occurs when the resource provider is not registered in your subscription
  • To register it, refer to [Register Resource Provider](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-register-resource-provider?tabs=azure-cli) documentation
| -------------------------------- @@ -99,7 +99,7 @@ Use these as quick reference guides to unblock your deployments. | **ResourceNameInvalid** | Resource name violates naming convention rules |
  • Ensure the resource name is within the allowed length and naming rules defined for that specific resource type, you can refer [Resource Naming Convention](https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/resource-name-rules) document
| | **Workspace Name - InvalidParameter** | Workspace name does not meet required format | To avoid this errors in workspace ID follow below rules:
  • Must start and end with an alphanumeric character (letter or number)
  • Allowed characters: `a–z`, `0–9`, `- (hyphen)`
  • Cannot start or end with a hyphen -
  • No spaces, underscores (_), periods (.), or special characters
  • Must be unique within the Azure region & subscription
  • Length: 3–33 characters (for AML workspaces)
| | **VaultNameNotValid** | Key Vault name does not meet naming requirements | In this template Vault name will be unique everytime, but if you trying to hard code the name then please make sure below points:
  • **Check name length** - Ensure the Key Vault name is between 3 and 24 characters
  • **Validate allowed characters** - The name can only contain letters (a–z, A–Z) and numbers (0–9). Hyphens are allowed, but not at the beginning or end, and not consecutive (--)
  • **Ensure proper start and end** - The name must start with a letter. The name must end with a letter or digit (not a hyphen)
  • **Test with a new name** - Example of a valid vault name: βœ… `cartersaikeyvault1`, βœ… `securevaultdemo`, βœ… `kv-project123`
| -| **BadRequest: Dns record under zone Document is already taken** | DNS record name already in use | This error can occur only when user hardcoding the CosmosDB Service name. To avoid this you can try few below suggestions:
  • Verify resource names are globally unique
  • If you already created an account/resource with same name in another subscription or resource group, check and delete it before reusing the name
  • By default in this template we are using unique prefix with every resource/account name to avoid this kind for errors
| +| **BadRequest: Dns record under zone Document is already taken** | DNS record name already in use | This error can occur only when user hardcoding the Azure Cosmos DB Service name. To avoid this you can try few below suggestions:
  • Verify resource names are globally unique
  • If you already created an account/resource with same name in another subscription or resource group, check and delete it before reusing the name
  • By default in this template we are using unique prefix with every resource/account name to avoid this kind for errors
| --------------------------------- @@ -109,7 +109,7 @@ Use these as quick reference guides to unblock your deployments. |-----------------|-------------|------------------| | **LinkedInvalidPropertyId/
ResourceNotFound/
DeploymentOutputEvaluationFailed/
CanNotRestoreANonExistingResource/
The language expression property array index is out of bounds** | Invalid or non-existent resource ID reference |
  • Before using any resource ID, ensure it follows the correct format
  • Verify that the resource ID you are passing actually exists
  • Make sure there are no typos in the resource ID
  • Verify that the provisioning state of the existing resource is `Succeeded` by running the following command to avoid this error while deployment or restoring the resource:
    `az resource show --ids --query "properties.provisioningState"`
  • Sample Resource IDs format:
    Log Analytics Workspace Resource ID: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.OperationalInsights/workspaces/{workspaceName}`
    Azure AI Foundry Project Resource ID: `/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.MachineLearningServices/workspaces/{name}`
  • You may encounter the error `The language expression property array index '8' is out of bounds` if the resource ID is incomplete. Please ensure your resource ID is correct and contains all required information, as shown in sample resource IDs
  • For more information refer [Resource Not Found errors solutions](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found?tabs=bicep)
| | **ParentResourceNotFound** | Parent resource does not exist or cannot be found |
  • You can refer to the [Parent Resource Not found](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-parent-resource?tabs=bicep) documentation if you encounter this error
| -| **PrincipalNotFound** | Principal ID does not exist in Azure AD tenant | This error occurs when the **principal ID** (Service Principal, User, or Group) specified in a role assignment or deployment does not exist in the Azure Active Directory tenant. It can also happen due to **replication delays** right after creating a new principal.

**Example causes:**
  • The specified **Object ID** is invalid or belongs to another tenant
  • The principal was recently created but Azure AD has not yet replicated it
  • Attempting to assign a role to a non-existing or deleted Service Principal/User/Group

**How to fix:**
  • Verify that the **principal ID is correct** and exists in the same directory/tenant:
    `az ad sp show --id `
  • If the principal was just created, wait a few minutes and retry
  • Explicitly set the principalType property (ServicePrincipal, User, or Group) in your ARM/Bicep template to avoid replication delays
  • If the principal does not exist, create it again before assigning roles
  • For more details, see [Azure PrincipalType documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting?tabs=bicep)
| +| **PrincipalNotFound** | Principal ID does not exist in Microsoft Entra ID tenant | This error occurs when the **principal ID** (Service Principal, User, or Group) specified in a role assignment or deployment does not exist in the Microsoft Entra ID tenant. It can also happen due to **replication delays** right after creating a new principal.

**Example causes:**
  • The specified **Object ID** is invalid or belongs to another tenant
  • The principal was recently created but Microsoft Entra ID has not yet replicated it
  • Attempting to assign a role to a non-existing or deleted Service Principal/User/Group

**How to fix:**
  • Verify that the **principal ID is correct** and exists in the same directory/tenant:
    `az ad sp show --id `
  • If the principal was just created, wait a few minutes and retry
  • Explicitly set the principalType property (ServicePrincipal, User, or Group) in your ARM/Bicep template to avoid replication delays
  • If the principal does not exist, create it again before assigning roles
  • For more details, see [Azure PrincipalType documentation](https://learn.microsoft.com/en-us/azure/role-based-access-control/troubleshooting?tabs=bicep)
| | **SubscriptionDoesNotHaveServer** | Referenced SQL Server does not exist in subscription | This issue happens when you try to reference an **Azure SQL Server** (`Microsoft.Sql/servers`) that does not exist in the selected subscription.

**It can occur if:**
  • The SQL server name is typed incorrectly
  • The SQL server was **deleted** but is still being referenced
  • You are working in the **wrong subscription context**
  • The server exists in a **different subscription/tenant** where you don't have access

**Reproduce:**
Run an Azure CLI command with a non-existent server name:
`az sql db list --server sql-doesnotexist --resource-group myResourceGroup`
or
`az sql server show --name sql-caqfrhxr4i3hyj --resource-group myResourceGroup`

**Resolution:**
  • Verify the SQL Server name exists in your subscription:
    `az sql server list --output table`
  • Make sure you are targeting the correct subscription:
    `az account show`
    `az account set --subscription `
  • If the server was deleted, either restore it (if possible) or update references to use a valid existing server
| --------------------------------- @@ -133,7 +133,7 @@ Use these as quick reference guides to unblock your deployments. | **InvalidRequestContent** | Deployment contains unrecognized or missing required values |
  • The deployment values either include values that aren't recognized, or required values are missing. Confirm the values for your resource type
  • You can refer [Invalid Request Content error](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/common-deployment-errors#:~:text=InvalidRequestContent,Template%20reference) documentation
| | **Conflict - Cannot use the SKU Basic with File Change Audit for site** | File Change Audit not supported on Basic SKU |
  • This error happens because File Change Audit logs aren't supported on Basic SKU App Service Plans
  • Upgrading to Premium/Isolated SKU (supports File Change Audit), or
  • Disabling File Change Audit in Diagnostic Settings if you must stay on Basic
  • Always cross-check the [supported log types](https://aka.ms/supported-log-types) before adding diagnostic logs to your Bicep templates
| | **AccountPropertyCannotBeUpdated** | Read-only property cannot be modified after creation | The property **`isHnsEnabled`** (Hierarchical Namespace for Data Lake Gen2) is **read-only** and can only be set during **storage account creation**. Once a storage account is created, this property **cannot be updated**. Trying to update it via ARM template, Bicep, CLI, or Portal will fail.

**Resolution:**
  • Create a **new storage account** with `isHnsEnabled=true` if you require hierarchical namespace
  • Migration may be needed if you already have data
  • Refer to [Storage Account Update Restrictions](https://aka.ms/storageaccountupdate) for more details
| -| **Conflict - Local authentication is disabled** | App Configuration store has local authentication disabled but application is using local auth mode | This error occurs when your Azure App Configuration store has **local authentication disabled** (`disableLocalAuth: true`) but your application is trying to access it using **connection strings or access keys** instead of **Azure AD/Managed Identity authentication**.

**Example error message:**
`The operation cannot be performed because the configuration store is using local authentication mode and local authentication is disabled. To enable access to data plane resources while local authentication is disabled, please use pass-through authentication mode.`

**Common causes:**
  • App Configuration store deployed with `disableLocalAuth: true` for security compliance
  • Application code using connection strings instead of Managed Identity
  • SDK client initialized with access keys rather than `DefaultAzureCredential`

**Resolution:**
  • **Option 1: Update application to use Managed Identity (Recommended)**
    ```python
    from azure.identity import DefaultAzureCredential
    from azure.appconfiguration import AzureAppConfigurationClient

    credential = DefaultAzureCredential()
    client = AzureAppConfigurationClient(
    endpoint="https://your-appconfig.azconfig.io",
    credential=credential
    )
    ```
  • **Option 2: Re-enable local authentication (Not recommended for production)**
    Set `disableLocalAuth: false` in your Bicep/ARM template
  • **Ensure proper RBAC assignment:** Verify that the Managed Identity has `App Configuration Data Reader` or `App Configuration Data Owner` role assigned

**Reference:**
  • [Disable local authentication in Azure App Configuration](https://learn.microsoft.com/en-us/azure/azure-app-configuration/howto-disable-access-key-authentication)
  • [Use Managed Identities to access App Configuration](https://learn.microsoft.com/en-us/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity)
| +| **Conflict - Local authentication is disabled** | App Configuration store has local authentication disabled but application is using local auth mode | This error occurs when your Azure App Configuration store has **local authentication disabled** (`disableLocalAuth: true`) but your application is trying to access it using **connection strings or access keys** instead of **Microsoft Entra ID/Managed Identity authentication**.

**Example error message:**
`The operation cannot be performed because the configuration store is using local authentication mode and local authentication is disabled. To enable access to data plane resources while local authentication is disabled, please use pass-through authentication mode.`

**Common causes:**
  • App Configuration store deployed with `disableLocalAuth: true` for security compliance
  • Application code using connection strings instead of Managed Identity
  • SDK client initialized with access keys rather than `DefaultAzureCredential`

**Resolution:**
  • **Option 1: Update application to use Managed Identity (Recommended)**
    ```python
    from azure.identity import DefaultAzureCredential
    from azure.appconfiguration import AzureAppConfigurationClient

    credential = DefaultAzureCredential()
    client = AzureAppConfigurationClient(
    endpoint="https://your-appconfig.azconfig.io",
    credential=credential
    )
    ```
  • **Option 2: Re-enable local authentication (Not recommended for production)**
    Set `disableLocalAuth: false` in your Bicep/ARM template
  • **Ensure proper RBAC assignment:** Verify that the Managed Identity has `App Configuration Data Reader` or `App Configuration Data Owner` role assigned

**Reference:**
  • [Disable local authentication in Azure App Configuration](https://learn.microsoft.com/en-us/azure/azure-app-configuration/howto-disable-access-key-authentication)
  • [Use Managed Identities to access App Configuration](https://learn.microsoft.com/en-us/azure/azure-app-configuration/howto-integrate-azure-managed-service-identity)
| | **PropertyChangeNotAllowed** | Immutable VM property cannot be changed after creation | This error occurs when you attempt to modify an immutable property (such as `osProfile.adminUsername`) on an existing VM.

**Cause (Azure Limitation):**
Once a VM is created, the `osProfile.adminUsername` property is immutable and cannot be changed. If you modify the VM username or password in the template and redeploy, this issue will occur.

**Note:** By default, the solution uses **Microsoft Entra ID authentication** for VM access (recommended). Username/password authentication is optional and not required.

**Resolution:**
  • **If using Entra ID (default):** No action needed - authentication uses your Azure credentials
  • **If using username/password (optional):** Delete the existing deployment and redeploy with new credentials:
    `azd down --force --purge`
  • Set new credentials before redeployment (if needed):
    `azd env set AZURE_ENV_VM_ADMIN_USERNAME "newusername"`
    `azd env set AZURE_ENV_VM_ADMIN_PASSWORD "NewSecurePassword123!"`
  • Redeploy:
    `azd up`

**Note:** Some VM properties are immutable by design. Entra ID authentication eliminates the need to manage VM credentials. | diff --git a/documents/customer-chatbot-product-roadmap.md b/documents/customer-chatbot-product-roadmap.md deleted file mode 100644 index d87665e5..00000000 --- a/documents/customer-chatbot-product-roadmap.md +++ /dev/null @@ -1,161 +0,0 @@ -# Product roadmap: unified accelerator β†’ split apps β†’ embeddable widget - -High-level sequence and status. Details: [`src/separationPlan.md`](../src/separationPlan.md), [`embeddable-chat-widget-technical-plan.md`](embeddable-chat-widget-technical-plan.md). - -**Status:** βœ… complete Β· πŸ”Ά partial / in progress Β· ⬜ not started - ---- - -## Sequence - -1. Monolithic accelerator (shop + chat in one deploy). -2. Split **`chat-app`** and **`ecommerce-app`** (UI + API per product). -3. Unified Azure deploy (**`infra_basic`**, four container App Services, **`cloud_build_acr`** postprovision). -4. Operational validation: data/agent scripts, QA on hosted URLs. -5. Embeddable widget from chat stack; ecommerce as first host; third-party and non-retail surfaces later. - ---- - -## Milestones - -| Milestone | Outcome | Status | -|-----------|---------|--------| -| Unified customer-chatbot accelerator | Single deploy: catalog, cart, conversational support; Azure Search / Cosmos / Foundry baseline. | βœ… | -| Separation design | Ecommerce vs support chat as separate products; documented in separation plan. | βœ… | -| **`chat-app`** / **`ecommerce-app`** layout | Each includes **`frontend/`**, **`backend/`**, **`infra/`**; per-app script copies for standalone **`azd`**. | βœ… | -| Unified **`infra_basic`** + **`azure.yaml`** | One resource group, ACR, four sites; postprovision builds four images and restarts all four web apps. | βœ… | -| Hosted config and CORS | Frontends load **`runtime-config.js`** for API base URL; backends use explicit **`ALLOWED_ORIGINS_STR`** (no **`*`** with credentialed clients). | βœ… | -| Container images match code | Chat and ecommerce **`requirements.txt`** aligned with imports; AcrPull uses current built-in role GUID. | βœ… | -| Post-deploy data and agents | **`infra/scripts/data_scripts/`** + **`agent_scripts/`**; still mostly manual / runbookβ€”automation after **`azd up`** open. | πŸ”Ά | -| Deployed QA sign-off | Auth, ecommerce flows, chat messaging, **`/health`**, error handling on production hostnames. | πŸ”Ά | -| Widget MVP | Script loader + Shadow DOM widget bundle; same chat API contract with SSE streaming. See technical plan. | ⬜ | -| Ecommerce embeds widget | Script or layout integration on **`ecommerce-app`** pointing at hosted loader. | ⬜ | -| Embed as product | Tenant keys, origin allowlist, partner docs, iframe a11y/perf, optional feature tiers (e.g. Voice Live). | ⬜ | - ---- - -## Embed program (order of work) - -1. Build widget frontend with React + Fluent UI using Vite library mode (`widget.js` output). -2. Implement script-loader embed with Shadow DOM isolation as default. -3. Host widget and backend on Azure App Service; keep FastAPI as API surface. -4. Integrate on ecommerce frontend using one script include + `ChatWidget.init(...)`. -5. Add iframe variant only if host-site CSS isolation or policy constraints require it. -6. Expand to third-party origins and partner docs after ecommerce validation. - -### Preferred implementation defaults (demo accelerator) - -| Area | Default | -|------|---------| -| Widget UI | React + Fluent UI | -| Build output | Vite library bundle (`widget.js`) | -| Embed method | Script loader + Shadow DOM | -| Backend | FastAPI | -| Streaming | SSE | -| Hosting | Azure App Service | -| Isolation fallback | iframe only if needed | - -### Avoid in initial phase - -- Multi-tenant platform design. -- Web PubSub / WebSockets-first transport. -- Microservices split for widget scope. -- CDN / Front Door layering unless a concrete need appears. -- Complex auth and distributed session patterns. - ---- - -## Beyond ecommerce (extensibility model) - -Same **Stable Core**, then **scenario** and **configuration** differentiationβ€”avoid per-vertical rewrites. - -### Stable Core - -| Item | Role | -|------|------| -| Reference architecture | Repeatable template for new PoCs / verticals. | -| Deployment automation | **`azd`**, Bicep, image build hooks. | -| Security baseline | Identity, secrets, network defaults. | -| Core agents and base UI | Foundry/agents + Fluent shell shared across scenarios. | - -### Scenario Packs - -Flow templates, demo scripts, data packs / index overlays, bundled rules and UI variants, industry-specific extension notes (e.g. retail vs. internal support). - -### Configuration Layer - -Custom data / schemas, agent instructions and policy rules, integration adapters (CRM, ticketing, storefronts), toggleable sub-features per tenant or SKU. - -### Customization Layer - -UI/UX integration points, tenant data wiring guides, auth/security runbooks, production network isolation where required. - ---- - -```mermaid -flowchart LR - subgraph done [Completed or mostly done] - A[Unified accelerator] - B[Separation design] - C[Split repos] - D[infra_basic plus cloud_build_acr] - E[Runtime URL and CORS] - F[Image and dependency fixes] - end - subgraph open [Open work] - G[Data agent automation] - H[Deployed QA] - I[Widget MVP] - J[Ecommerce embed] - K[Partner-ready embed] - L[Horizontal scenario packs] - end - A --> B --> C --> D --> E --> F - F --> G --> H --> I --> J --> K --> L -``` - -```mermaid -flowchart TB - rg[ResourceGroup] - ef[ecommerce-frontend-appservice] - eb[ecommerce-backend-fastapi] - wf[ai-widget-frontend-appservice] - wb[ai-widget-backend-fastapi] - rg --> ef - rg --> eb - rg --> wf - rg --> wb -``` - -Embed contract on ecommerce: - -```html - -``` - -Optional single-app variant for fastest demo iteration: - -```text -ai-widget-fastapi-appservice - -> serves /widget.js and /assets/* - -> serves /api/chat (SSE) -``` - ---- - -## Related documents - -| Document | Use | -|----------|-----| -| [`src/separationPlan.md`](../src/separationPlan.md) | Infrastructure, **`postprovision`**, Β§11 validation. | -| [`embeddable-chat-widget-technical-plan.md`](embeddable-chat-widget-technical-plan.md) | Shadow DOM embed, FastAPI/SSE, CORS, packaging. | - ---- - -## Review cadence - -| Frequency | Audience | Focus | -|-----------|----------|--------| -| Monthly | Engineering, platform | Releases, **`azd`**, hooks, regressions | -| Six weeks | Product, UX | Widget UX, accessibility, performance budgets | -| Quarterly | Partnerships | Scenario packs, onboarding, non-retail rollout | diff --git a/documents/embeddable-chat-widget-technical-plan.md b/documents/embeddable-chat-widget-technical-plan.md deleted file mode 100644 index 99de1958..00000000 --- a/documents/embeddable-chat-widget-technical-plan.md +++ /dev/null @@ -1,232 +0,0 @@ -# Technical plan: embeddable Chat widget (chat-app origins, any-host embed) - -This document specifies how to deliver a **small, embeddable client** sourced from **chat-app** capabilities, **without merging** chat and ecommerce repos. Host sites (starting with ecommerce-app, later arbitrary domains) load the widget the same way a third-party would. - -Product milestones and roadmap context live in **[customer-chatbot-product-roadmap.md](customer-chatbot-product-roadmap.md)**. - -**Progress snapshot (13 May 2026):** Local end-to-end works for the full **chat-app** SPA and for the widget embedded in **ecommerce-app** (script load, Shadow DOM, chat API). Hosted **Azure** path is wired in **`infra_basic`** (widget ships with the chat frontend image; ecommerce gets runtime URLs for widget script + chat API). Remaining gaps vs this plan: **SSE streaming**, **`rid` / OTel embed correlation**, **M4 polish (SRI, iframe fallback)**, and validation that **Foundry agent names** and **Easy Auth cross-origin** behave as expected in production. Details: [Β§11](#11-implementation-progress-and-deploy-readiness). - -## 1. Objectives - -- One **distribution artifact** developers can paste into arbitrary HTML (script embed). -- **Runtime configuration** only (API base URL, optional tenant/widget id, theme tokens). No compile-time coupling to ecommerce-app. -- **Security-first**: predictable CORS/auth story, CSP-friendly embedding options, minimized XSS surface. -- **Parity**: reuse chat backend routes already used by full chat SPA (`/api/chat/*`, auth, Voice Live where applicable). -- **Simplicity first**: architecture optimized for demo velocity on Azure App Service. - -## 2. Non-goals - -- Folding chat UI into ecommerce-app bundles or importing ecommerce source into chat. -- Replacing the full-screen chat SPA except as a **standalone** fallback for unsupported browsers or iframe-blocked contexts. -- Designing full multi-tenant control planes in initial release. -- Introducing Web PubSub, microservices, AKS, Front Door, or distributed session architecture for MVP. - -## 3. Embedding model (recommended stack) - -Default to one pattern and keep one fallback. - -### 3.1 Primary: script loader + Shadow DOM (recommended) - -| Concern | How it is addressed | -|--------|----------------------| -| **CSS isolation** | Widget mounts inside a Shadow Root to isolate host CSS and reduce style collisions. | -| **Embed simplicity** | Host adds one script include and calls `ChatWidget.init(...)`. | -| **Debugging** | Single-window runtime avoids cross-window message inspection for initial MVP. | -| **Versioning** | `widget.js` path/version controls rollout; host integration remains stable. | - -**Mechanics** - -1. Host page loads `https:///widget.js`. -2. `widget.js` creates a host node, attaches Shadow Root, and mounts React app. -3. Widget calls FastAPI APIs on same origin or configured `apiBaseUrl`. - -Reference shape: - -```text -class ChatWidget { - init() { - const host = document.createElement("div") - document.body.appendChild(host) - const shadowRoot = host.attachShadow({ mode: "open" }) - createRoot(shadowRoot).render() - } -} -window.ChatWidget = new ChatWidget() -``` - -### 3.2 Fallback: iframe loader (only when required) - -Use iframe only if a target host has blocking CSS/policy behavior that Shadow DOM cannot address safely. - -## 4. Frontend architecture - -```mermaid -flowchart LR - HostPage[Host ecommerce or external site] - Loader[widget.js loader] - Shadow[ShadowRoot React widget] - Api[chat FastAPI backend] - HostPage --> Loader - Loader --> Shadow - Shadow --> Api -``` - -**Frontend build targets** - -- **Vite library mode** for `widget.js` bundle. -- React + Fluent UI component tree focused on floating launcher + panel. -- No full SPA routing for widget package. - -Example embed API: - -```html - - -``` - -## 5. Backend and CORS contract - -Widget backend remains FastAPI. - -Primary API scope: - -- `POST /api/chat` or streaming equivalent. -- Azure OpenAI orchestration. -- Session state for active widget conversation. - -Streaming recommendation: - -- Use SSE first (`EventSourceResponse`) instead of WebSockets. -- Keep protocol simple for incremental token streaming. - -CORS: - -- Explicit host allowlist only. -- No wildcard `*` for credentialed flows. - -## 6. Observability and operations - -- Widget requests carry **`rid=`** correlation id propagated to OTel **`embed.request_id`**. -- Feature flags (`widget.voice_live.enabled`) backend-driven to avoid mismatched UX. - -## 7. Packaging and delivery - -| Artifact | Host | -|----------|------| -| `widget.js` | App Service static path (preferred for MVP) | -| static assets (`/assets/*`) | Same App Service as widget backend or widget frontend | -| Integrity | **`SRI hash`** published in README + changelog | - -Semantic versioning **`MAJOR`** for breaking **`postMessage`** or config schema. - -### Deployment options - -Preferred for fastest demo loop: - -```text -ai-widget-fastapi-appservice - -> /widget.js - -> /assets/* - -> /api/chat (SSE) -``` - -Alternative (keep current four-app split): - -```text -ResourceGroup - -> ecommerce-frontend-appservice - -> ecommerce-backend-fastapi - -> ai-widget-frontend-appservice - -> ai-widget-backend-fastapi -``` - -## 8. Milestones (technical) - -Sequencing aligns with later roadmap milestones (**Embed widget MVP** onward) in [customer-chatbot-product-roadmap.md](customer-chatbot-product-roadmap.md). - -### M1 Widget shell - -- Vite library build for `widget.js`. -- Shadow DOM mount + floating launcher/panel UX. -- Script embed + `ChatWidget.init({ apiBaseUrl, theme })`. - -### M2 Backend hardening for third-party origins - -- SSE endpoint for streamed responses. -- Explicit origin allowlist and simplified token/session flow. -- Keep auth straightforward for accelerator demo scope. - -### M3 ecommerce-app integration PoC - -- Add script include to **`ecommerce-app/frontend`** and initialize widget. -- Validate CSS isolation, mobile behavior, and focus/keyboard interactions. - -### M4 Polish and CDN - -- SRI, minified bundle, Lighthouse budget, error boundary UX. -- Introduce iframe variant only if required by host constraints. - -### M5 Extensions - -- Optional tenant mapping, partner snippets, and advanced entitlements. -- Defer distributed auth/session patterns until scale requires them. - -## 9. Risks and mitigations - -| Risk | Mitigation | -|------|------------| -| Host CSS affects widget | Shadow DOM by default. | -| Cookie SameSite failures | Prefer simple token/session flow; avoid cross-site cookie dependence for MVP. | -| Style drift | Single Fluent theme manifest shared between SPA and widget build (shared token JSON if needed). | - -## 10. References in repo - -- Chat UI entry: [`chat-app/frontend`](../chat-app/frontend) -- Widget bundle: [`chat-app/frontend/vite.widget.config.ts`](../chat-app/frontend/vite.widget.config.ts), [`chat-app/frontend/src/widget-bootstrap.ts`](../chat-app/frontend/src/widget-bootstrap.ts), [`chat-app/frontend/src/widget.tsx`](../chat-app/frontend/src/widget.tsx), [`chat-app/frontend/src/WidgetApp.tsx`](../chat-app/frontend/src/WidgetApp.tsx) -- Ecommerce embed: [`ecommerce-app/frontend/src/embedChatWidget.ts`](../ecommerce-app/frontend/src/embedChatWidget.ts) -- Separation context: [`src/separationPlan.md`](../src/separationPlan.md) -- Cloud deploy / CORS: [`infra_basic/main.bicep`](../infra_basic/main.bicep) app settings - -## 11. Implementation progress and deploy readiness - -### 11.1 Where things stand vs milestones - -| Milestone | Plan intent | Current state | -|-----------|-------------|---------------| -| **M1 Widget shell** | Vite library `widget.js`, Shadow DOM, `ChatWidget.init`, launcher/panel | **Done.** Second Vite build ([`chat-app/frontend/vite.widget.config.ts`](../chat-app/frontend/vite.widget.config.ts)) outputs IIFE `widget.js` from [`widget-bootstrap.ts`](../chat-app/frontend/src/widget-bootstrap.ts). [`widget.tsx`](../chat-app/frontend/src/widget.tsx) mounts Shadow DOM, inlines CSS, sets API base + embed auth base. [`WidgetApp.tsx`](../chat-app/frontend/src/WidgetApp.tsx) provides floating control + panel and reuses **`ChatSidebar`** (text + voice hooks same as SPA stack). | -| **M2 Backend / third-party** | SSE, explicit CORS, straightforward auth | **Partial.** CORS is explicit (`allow_credentials=True`, no `*`); unified deploy sets chat API **`ALLOWED_ORIGINS_STR`** to **both** chat and ecommerce frontend origins ([`infra_basic/main.bicep`](../infra_basic/main.bicep) chat backend block). Chat still uses **`POST /api/chat/message`** with a **single JSON** assistant reply ([`chat-app/backend/app/routers/chat.py`](../chat-app/backend/app/routers/chat.py)), not **SSE** as recommended in Β§5. Optional auth path exists; embed uses **`/.auth/me`** on the **widget script origin** ([`AuthContext.tsx`](../chat-app/frontend/src/contexts/AuthContext.tsx) + [`embedContext.ts`](../chat-app/frontend/src/lib/embedContext.ts)). **Β§6** correlation (**`rid` β†’ `embed.request_id`**) is **not** implemented. | -| **M3 Ecommerce PoC** | Script on ecommerce, validate isolation / mobile / a11y | **Done for integration plumbing.** [`ecommerce-app/frontend/src/embedChatWidget.ts`](../ecommerce-app/frontend/src/embedChatWidget.ts) injects `widget.js`, then calls `ChatWidget.init` with **`VITE_CHAT_API_BASE_URL`** / theme from env or **`window.__RUNTIME_CONFIG__`**. [`main.tsx`](../ecommerce-app/frontend/src/main.tsx) invokes **`embedChatWidget()`**. Dev server serves built `widget.js` from chat `dist` via [`ecommerce-app/frontend/vite.config.ts`](../ecommerce-app/frontend/vite.config.ts). Formal **mobile / keyboard / a11y** sign-off not recorded here. | -| **M4 Polish** | SRI, minify/Lighthouse, iframe fallback | **Not done** (widget build still emits **sourcemaps** in [`vite.widget.config.ts`](../chat-app/frontend/vite.widget.config.ts); no published **SRI** hash; **iframe** loader not built). | -| **M5 Extensions** | Tenants, partner snippets | **Not started.** | - -### 11.2 Repo map (implemented pieces) - -| Area | Location | -|------|----------| -| Widget library entry + `init` | [`chat-app/frontend/src/widget-bootstrap.ts`](../chat-app/frontend/src/widget-bootstrap.ts) | -| Shadow mount + config | [`chat-app/frontend/src/widget.tsx`](../chat-app/frontend/src/widget.tsx) | -| Widget UI | [`chat-app/frontend/src/WidgetApp.tsx`](../chat-app/frontend/src/WidgetApp.tsx) | -| SPA + widget API base override | [`chat-app/frontend/src/lib/api.ts`](../chat-app/frontend/src/lib/api.ts) | -| Host embed loader | [`ecommerce-app/frontend/src/embedChatWidget.ts`](../ecommerce-app/frontend/src/embedChatWidget.ts) | -| Ecommerce runtime injection (Azure hostnames) | [`ecommerce-app/frontend/startup.sh`](../ecommerce-app/frontend/startup.sh) | -| Chat image includes SPA + `widget.js` | [`chat-app/frontend/Dockerfile`](../chat-app/frontend/Dockerfile) (`npm run build` β†’ `dist/` copied to nginx) | -| Infra: ecommerce β†’ chat widget + API URLs | [`infra_basic/main.bicep`](../infra_basic/main.bicep) (`VITE_CHAT_WIDGET_ORIGIN`, `VITE_CHAT_API_BASE_URL` on ecommerce frontend module) | - -### 11.3 Ready to deploy and see it end-to-end? - -**You are in good shape to try a hosted run** if images are current and post-provision agent settings are populated: the **same** `npm run build` that the chat frontend Dockerfile already runs produces **`widget.js`** alongside the SPA, and ecommerce startup / Bicep supply the **chat frontend origin** (script) and **chat API base** (XHR). - -**Checklist before calling hosted embed β€œdone”:** - -1. **Images** β€” Redeploy **chat-frontend** after any widget change so **`/widget.js`** on the chat site matches the bundle you tested. -2. **Browser network** β€” From the **ecommerce** origin, confirm **`GET https:///widget.js`**, then **`POST https:///api/chat/...`** without CORS errors (chat API allowlist already includes **both** frontends in **`infra_basic`**). -3. **AI path** β€” Chat backend needs working **Foundry** (or equivalent) config for real replies; template leaves agent name env placeholders in some pathsβ€”confirm **`FOUNDRY_*_AGENT`** (or your post-provision automation) matches deployed agents. -4. **Auth** β€” Widget may run as **guest** unless **`fetch` to `https:///.auth/me`** from the ecommerce page succeeds (cross-origin **cookies + CORS** on the chat App Service). Treat signed-in parity as **environment-dependent** until verified. -5. **Custom domains** β€” If you move off `*.azurewebsites.net`, update **`ALLOWED_ORIGINS_STR`** and the **`VITE_*`** / runtime URLs accordingly. - -**Summary:** Local **M1 + M3** goals are met; **M2** is partially met (CORS yes, SSE and embed **`rid`** no); **M4–M5** are open. You can **deploy and smoke-test** the embed on Azure; treat **streaming**, **observability correlation**, and **M4** items as follow-up work, not blockers for a first **β€œsee it live”** pass. diff --git a/infra/avm/main.bicep b/infra/avm/main.bicep index d6f66a1a..60730cd8 100644 --- a/infra/avm/main.bicep +++ b/infra/avm/main.bicep @@ -59,7 +59,7 @@ param tags object = {} ] } }) -@description('Required. Location for AI Foundry and model deployments.') +@description('Required. Location for Azure AI Foundry and model deployments.') param azureAiServiceLocation string @description('Deployment scenario: ecommerce, healthcare, or banking') @@ -151,7 +151,7 @@ param enablePrivateNetworking bool = false @description('Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one when monitoring is enabled.') param existingLogAnalyticsWorkspaceId string = '' -@description('Optional. Resource ID of an existing AI Foundry project. Empty creates a new one.') +@description('Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one.') param existingFoundryProjectResourceId string = '' // ============================================================================ @@ -166,7 +166,7 @@ param deployingUserPrincipalType string = 'User' // Parameters β€” WAF: Private Networking // ============================================================================ -@description('Optional. Secondary CosmosDB location for high availability.') +@description('Optional. Secondary Azure Cosmos DB location for high availability.') param secondaryLocation string = 'canadacentral' @secure() @@ -1109,43 +1109,43 @@ output AZURE_AI_AGENT_API_VERSION string = azureAiAgentApiVersion @description('Name of the Azure AI Foundry project.') output AZURE_AI_PROJECT_NAME string = aiProjectName -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') output AZURE_COSMOSDB_ACCOUNT string = cosmosDBModule.outputs.name -@description('Cosmos DB endpoint URL.') +@description('Azure Cosmos DB endpoint URL.') output COSMOS_DB_ENDPOINT string = cosmosDBModule.outputs.endpoint -@description('Name of the Cosmos DB database.') +@description('Name of the Azure Cosmos DB database.') output COSMOS_DB_DATABASE_NAME string = cosmosDBModule.outputs.databaseName -@description('Name of the Cosmos DB container for chat conversations.') +@description('Name of the Azure Cosmos DB container for chat conversations.') output AZURE_COSMOSDB_CONVERSATIONS_CONTAINER string = 'chat_sessions' -@description('Name of the Cosmos DB database (alias).') +@description('Name of the Azure Cosmos DB database (alias).') output AZURE_COSMOSDB_DATABASE string = cosmosDBModule.outputs.databaseName -@description('Azure OpenAI GPT model deployment name.') +@description('OpenAI GPT model deployment name.') output AZURE_OPENAI_DEPLOYMENT_MODEL string = gptModelName -@description('Azure OpenAI embedding model name.') +@description('OpenAI embedding model name.') output AZURE_OPENAI_EMBEDDING_MODEL string = embeddingModel -@description('Azure OpenAI embedding model deployment capacity.') +@description('OpenAI embedding model deployment capacity.') output AZURE_OPENAI_EMBEDDING_MODEL_CAPACITY int = embeddingDeploymentCapacity -@description('Azure OpenAI service endpoint URL.') +@description('OpenAI service endpoint URL.') output AZURE_OPENAI_ENDPOINT string = aiFoundryEndpoint -@description('Azure OpenAI model deployment type.') +@description('OpenAI model deployment type.') output AZURE_OPENAI_MODEL_DEPLOYMENT_TYPE string = deploymentType @description('Azure AI Search service endpoint URL.') output AZURE_AI_SEARCH_ENDPOINT string = ai_search.outputs.endpoint -@description('API version for Azure OpenAI service.') +@description('API version for OpenAI service.') output AZURE_OPENAI_API_VERSION string = azureOpenaiAPIVersion -@description('Name of the Azure OpenAI resource.') +@description('Name of the OpenAI resource.') output AZURE_OPENAI_RESOURCE string = aiFoundryName @description('React application layout configuration JSON.') diff --git a/infra/avm/main.json b/infra/avm/main.json index fbce071e..9036162f 100644 --- a/infra/avm/main.json +++ b/infra/avm/main.json @@ -71,7 +71,7 @@ "OpenAI.GlobalStandard.gpt-realtime-mini,1" ] }, - "description": "Required. Location for AI Foundry and model deployments." + "description": "Required. Location for Azure AI Foundry and model deployments." } }, "deploymentScenario": { @@ -166,7 +166,7 @@ "type": "string", "defaultValue": "2025-01-01-preview", "metadata": { - "description": "Optional. Azure OpenAI API version." + "description": "Optional. OpenAI API version." } }, "azureAiAgentApiVersion": { @@ -237,7 +237,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one." + "description": "Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one." } }, "deployingUserPrincipalType": { @@ -255,7 +255,7 @@ "type": "string", "defaultValue": "canadacentral", "metadata": { - "description": "Optional. Secondary CosmosDB location for high availability." + "description": "Optional. Secondary Azure Cosmos DB location for high availability." } }, "vmAdminUsername": { @@ -24848,7 +24848,7 @@ "type": "string", "defaultValue": "[format('proj-{0}', parameters('solutionName'))]", "metadata": { - "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}." + "description": "Optional. Override name for the Azure AI Foundry project. Defaults to proj-{solutionName}." } }, "location": { @@ -24882,7 +24882,7 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "Optional. Whether to allow project management (AI Foundry hub)." + "description": "Optional. Whether to allow project management (Azure AI Foundry hub)." } }, "publicNetworkAccess": { @@ -25363,7 +25363,7 @@ }, "metadata": { "__bicep_export!": true, - "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." + "description": "Type for network configuration in Azure AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." } }, "_1.secretSetOutputType": { @@ -26189,7 +26189,7 @@ "$ref": "#/definitions/networkInjectionType", "nullable": true, "metadata": { - "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." + "description": "Optional. Specifies in Azure AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network." } }, "privateEndpoints": { @@ -26244,7 +26244,7 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons." + "description": "Optional. Allow only Microsoft Entra ID authentication. Should be enabled for security reasons." } }, "customerManagedKey": { @@ -26327,7 +26327,7 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Enable/Disable project management feature for AI Foundry." + "description": "Optional. Enable/Disable project management feature for Azure AI Foundry." } }, "commitmentPlans": { @@ -27515,7 +27515,7 @@ "azureOpenAiCuEndpoint": { "type": "string", "metadata": { - "description": "Azure OpenAI Content Understanding endpoint URL." + "description": "OpenAI Content Understanding endpoint URL." }, "value": "[reference('aiServices').endpoints['Content Understanding']]" }, @@ -27529,23 +27529,23 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, "projectEndpoint": { "type": "string", "metadata": { - "description": "AI Foundry project endpoint." + "description": "Azure AI Foundry project endpoint." }, - "value": "[reference('aiProject').endpoints['AI Foundry API']]" + "value": "[reference('aiProject').endpoints['Azure AI Foundry API']]" }, "projectIdentityPrincipalId": { "type": "string", @@ -28425,7 +28425,7 @@ "azureOpenAiCuEndpoint": { "type": "string", "metadata": { - "description": "Azure OpenAI Content Understanding endpoint URL." + "description": "OpenAI Content Understanding endpoint URL." }, "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]" }, @@ -28439,23 +28439,23 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, "projectEndpoint": { "type": "string", "metadata": { - "description": "AI Foundry project endpoint." + "description": "Azure AI Foundry project endpoint." }, - "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]" + "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['Azure AI Foundry API']]" }, "projectIdentityPrincipalId": { "type": "string", @@ -29188,7 +29188,7 @@ "type": "array", "defaultValue": [], "metadata": { - "description": "Optional. Array of role assignments to create on the AI Search service." + "description": "Optional. Array of role assignments to create on the Azure AI Search service." } } }, @@ -31297,21 +31297,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Search service." + "description": "Resource ID of the Azure AI Search service." }, "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]" }, "name": { "type": "string", "metadata": { - "description": "Name of the AI Search service." + "description": "Name of the Azure AI Search service." }, "value": "[parameters('name')]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint URL of the AI Search service." + "description": "Endpoint URL of the Azure AI Search service." }, "value": "[format('https://{0}.search.windows.net', parameters('name'))]" }, @@ -31383,7 +31383,7 @@ "projectName": { "type": "string", "metadata": { - "description": "Required. Name of the AI Foundry project." + "description": "Required. Name of the Azure AI Foundry project." } }, "solutionName": { @@ -31937,7 +31937,7 @@ "type": "string", "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." } }, "location": { @@ -32356,7 +32356,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. An array that contains the Resource Ids for Network Acl Bypass for the Cosmos DB account." + "description": "Optional. An array that contains the Resource Ids for Network Acl Bypass for the Azure Cosmos DB account." } } }, @@ -34098,7 +34098,7 @@ "type": "bool", "defaultValue": false, "metadata": { - "description": "Optional. Enables the cassandra connector on the Cosmos DB C* account." + "description": "Optional. Enables the cassandra connector on the Azure Cosmos DB C* account." } }, "enablePartitionMerge": { @@ -34131,7 +34131,7 @@ "__bicep_resource_derived_type!": { "source": "Microsoft.DocumentDB/databaseAccounts@2025-04-15#properties/properties/properties/cors" }, - "description": "Optional. The CORS policy for the Cosmos DB database account." + "description": "Optional. The CORS policy for the Azure Cosmos DB database account." }, "nullable": true }, @@ -34141,7 +34141,7 @@ "name": "FirstPartyIdentity" }, "metadata": { - "description": "Optional. The default identity for accessing key vault used in features like customer managed keys. Use `FirstPartyIdentity` to use the tenant-level CosmosDB enterprise application. The default identity needs to be explicitly set by the users." + "description": "Optional. The default identity for accessing key vault used in features like customer managed keys. Use `FirstPartyIdentity` to use the tenant-level Azure Cosmos DB enterprise application. The default identity needs to be explicitly set by the users." } }, "customerManagedKey": { @@ -34165,8 +34165,8 @@ "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(variables('formattedUserAssignedIdentities'))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(variables('formattedUserAssignedIdentities'))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]", "builtInControlPlaneRoleNames": { "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]", - "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]", - "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", + "Azure Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]", + "Azure Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]", "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]", "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]", "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]", @@ -34347,7 +34347,7 @@ "templateHash": "3972888645334640168" }, "name": "DocumentDB Database Account SQL Databases", - "description": "This module deploys a SQL Database in a CosmosDB Account." + "description": "This module deploys a SQL Database in a Azure Cosmos DB Account." }, "definitions": { "containerType": { @@ -34603,7 +34603,7 @@ "templateHash": "4781880351108045502" }, "name": "DocumentDB Database Account SQL Database Containers", - "description": "This module deploys a SQL Database Container in a CosmosDB Account." + "description": "This module deploys a SQL Database Container in a Azure Cosmos DB Account." }, "parameters": { "databaseAccountName": { @@ -34871,7 +34871,7 @@ "templateHash": "8514367433037227852" }, "name": "DocumentDB Database Account SQL Role Definitions.", - "description": "This module deploys a SQL Role Definision in a CosmosDB Account." + "description": "This module deploys a SQL Role Definision in a Azure Cosmos DB Account." }, "definitions": { "sqlRoleAssignmentType": { @@ -35048,7 +35048,7 @@ "templateHash": "11817543900771838380" }, "name": "DocumentDB Database Account SQL Role Assignments.", - "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + "description": "This module deploys a SQL Role Assignment in a Azure Cosmos DB Account." }, "parameters": { "databaseAccountName": { @@ -35093,8 +35093,8 @@ }, "variables": { "builtInDataPlaneRoleNames": { - "Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]", - "Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]" + "Azure Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]", + "Azure Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]" }, "formattedRoleDefinition": "[coalesce(tryGet(variables('builtInDataPlaneRoleNames'), parameters('roleDefinitionIdOrName')), if(contains(parameters('roleDefinitionIdOrName'), '/sqlRoleDefinitions/'), parameters('roleDefinitionIdOrName'), format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('roleDefinitionIdOrName'))))]", "formattedScope": "[replace(replace(coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))), '/sqlDatabases/', '/dbs/'), '/containers/', '/colls/')]" @@ -35247,7 +35247,7 @@ "templateHash": "11817543900771838380" }, "name": "DocumentDB Database Account SQL Role Assignments.", - "description": "This module deploys a SQL Role Assignment in a CosmosDB Account." + "description": "This module deploys a SQL Role Assignment in a Azure Cosmos DB Account." }, "parameters": { "databaseAccountName": { @@ -35292,8 +35292,8 @@ }, "variables": { "builtInDataPlaneRoleNames": { - "Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]", - "Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]" + "Azure Cosmos DB Built-in Data Reader": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000001', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]", + "Azure Cosmos DB Built-in Data Contributor": "[format('{0}/sqlRoleDefinitions/00000000-0000-0000-0000-000000000002', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))]" }, "formattedRoleDefinition": "[coalesce(tryGet(variables('builtInDataPlaneRoleNames'), parameters('roleDefinitionIdOrName')), if(contains(parameters('roleDefinitionIdOrName'), '/sqlRoleDefinitions/'), parameters('roleDefinitionIdOrName'), format('{0}/sqlRoleDefinitions/{1}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('roleDefinitionIdOrName'))))]", "formattedScope": "[replace(replace(coalesce(parameters('scope'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))), '/sqlDatabases/', '/dbs/'), '/containers/', '/colls/')]" @@ -35414,7 +35414,7 @@ "templateHash": "10787709019875067397" }, "name": "DocumentDB Database Account Cassandra Role Definitions.", - "description": "This module deploys a Cassandra Role Definition in a CosmosDB Account." + "description": "This module deploys a Cassandra Role Definition in a Azure Cosmos DB Account." }, "definitions": { "cassandraRoleAssignmentType": { @@ -35571,7 +35571,7 @@ "templateHash": "14764024820910071147" }, "name": "DocumentDB Database Account Cassandra Role Assignments.", - "description": "This module deploys a Cassandra Role Assignment in a CosmosDB Account." + "description": "This module deploys a Cassandra Role Assignment in a Azure Cosmos DB Account." }, "parameters": { "databaseAccountName": { @@ -35725,7 +35725,7 @@ "templateHash": "14764024820910071147" }, "name": "DocumentDB Database Account Cassandra Role Assignments.", - "description": "This module deploys a Cassandra Role Assignment in a CosmosDB Account." + "description": "This module deploys a Cassandra Role Assignment in a Azure Cosmos DB Account." }, "parameters": { "databaseAccountName": { @@ -35854,7 +35854,7 @@ "templateHash": "13897098552792121791" }, "name": "DocumentDB Database Account MongoDB Databases", - "description": "This module deploys a MongoDB Database within a CosmosDB Account." + "description": "This module deploys a MongoDB Database within a Azure Cosmos DB Account." }, "definitions": { "collectionType": { @@ -35902,7 +35902,7 @@ "databaseAccountName": { "type": "string", "metadata": { - "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + "description": "Conditional. The name of the parent Azure Cosmos DB database account. Required if the template is used in a standalone deployment." } }, "name": { @@ -36020,7 +36020,7 @@ "databaseAccountName": { "type": "string", "metadata": { - "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment." + "description": "Conditional. The name of the parent Azure Cosmos DB database account. Required if the template is used in a standalone deployment." } }, "mongodbDatabaseName": { @@ -36179,7 +36179,7 @@ "templateHash": "11959636451300474346" }, "name": "DocumentDB Database Account Gremlin Databases", - "description": "This module deploys a Gremlin Database within a CosmosDB Account." + "description": "This module deploys a Gremlin Database within a Azure Cosmos DB Account." }, "definitions": { "graphType": { @@ -36659,7 +36659,7 @@ "templateHash": "15257396763463366586" }, "name": "DocumentDB Database Account Cassandra Keyspaces", - "description": "This module deploys a Cassandra Keyspace within a CosmosDB Account." + "description": "This module deploys a Cassandra Keyspace within a Azure Cosmos DB Account." }, "definitions": { "tableType": { @@ -36790,7 +36790,7 @@ "databaseAccountName": { "type": "string", "metadata": { - "description": "Conditional. The name of the parent Cosmos DB account. Required if the template is used in a standalone deployment." + "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment." } }, "tables": { @@ -36903,7 +36903,7 @@ "templateHash": "15998065591386988132" }, "name": "DocumentDB Database Account Cassandra Keyspaces Tables", - "description": "This module deploys a Cassandra Table within a Cassandra Keyspace in a CosmosDB Account." + "description": "This module deploys a Cassandra Table within a Cassandra Keyspace in a Azure Cosmos DB Account." }, "parameters": { "name": { @@ -37080,7 +37080,7 @@ "templateHash": "6617803098467821091" }, "name": "DocumentDB Database Account Cassandra Keyspaces Views", - "description": "This module deploys a Cassandra View (Materialized View) within a Cassandra Keyspace in a CosmosDB Account." + "description": "This module deploys a Cassandra View (Materialized View) within a Cassandra Keyspace in a Azure Cosmos DB Account." }, "parameters": { "name": { @@ -38018,21 +38018,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the Cosmos DB account." + "description": "Resource ID of the Azure Cosmos DB account." }, "value": "[reference('cosmosAccount').outputs.resourceId.value]" }, "name": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[reference('cosmosAccount').outputs.name.value]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint of the Cosmos DB account." + "description": "Endpoint of the Azure Cosmos DB account." }, "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]" }, @@ -38597,7 +38597,7 @@ "type": "string", "defaultValue": "enabled", "metadata": { - "description": "Azure AD authentication as ARM policy status." + "description": "Microsoft Entra ID authentication as ARM policy status." } } }, @@ -45295,7 +45295,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -45315,7 +45315,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -45339,14 +45339,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -45500,7 +45500,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -45801,14 +45801,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -45834,7 +45834,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -45843,7 +45843,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -45878,13 +45878,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -45910,7 +45910,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -45939,7 +45939,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -45980,13 +45980,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -46339,7 +46339,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -50407,7 +50407,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -50427,7 +50427,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -50451,14 +50451,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -50612,7 +50612,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -50911,14 +50911,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -50944,7 +50944,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -50953,7 +50953,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -50988,13 +50988,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -51020,7 +51020,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -51049,7 +51049,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -51090,13 +51090,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -51449,7 +51449,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -60861,7 +60861,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -60881,7 +60881,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -60905,14 +60905,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -61066,7 +61066,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -61367,14 +61367,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -61400,7 +61400,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -61409,7 +61409,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -61444,13 +61444,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -61476,7 +61476,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -61505,7 +61505,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -61546,13 +61546,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -61905,7 +61905,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -65973,7 +65973,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -65993,7 +65993,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -66017,14 +66017,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -66178,7 +66178,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -66477,14 +66477,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -66510,7 +66510,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -66519,7 +66519,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -66554,13 +66554,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -66586,7 +66586,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -66615,7 +66615,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -66656,13 +66656,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -67015,7 +67015,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -76469,7 +76469,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -76489,7 +76489,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -76513,14 +76513,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -76674,7 +76674,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -76975,14 +76975,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -77008,7 +77008,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -77017,7 +77017,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -77052,13 +77052,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -77084,7 +77084,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -77113,7 +77113,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -77154,13 +77154,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -77513,7 +77513,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -81581,7 +81581,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -81601,7 +81601,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -81625,14 +81625,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -81786,7 +81786,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -82085,14 +82085,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -82118,7 +82118,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -82127,7 +82127,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -82162,13 +82162,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -82194,7 +82194,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -82223,7 +82223,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -82264,13 +82264,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -82623,7 +82623,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -92038,7 +92038,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -92058,7 +92058,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -92082,14 +92082,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -92243,7 +92243,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -92544,14 +92544,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -92577,7 +92577,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -92586,7 +92586,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -92621,13 +92621,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -92653,7 +92653,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -92682,7 +92682,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -92723,13 +92723,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -93082,7 +93082,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -97150,7 +97150,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. Gets a JSON string containing the Azure AD Acl settings." + "description": "Optional. Gets a JSON string containing the Microsoft Entra ID Acl settings." } }, "additionalLoginParams": { @@ -97170,7 +97170,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Azure Active Directory. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." + "description": "Optional. Allowed audience values to consider when validating JSON Web Tokens issued by Microsoft Entra ID. Note that the `ClientID` value is always considered an allowed audience, regardless of this setting." } }, "allowedExternalRedirectUrls": { @@ -97194,14 +97194,14 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecret": { "type": "securestring", "nullable": true, "metadata": { - "description": "Optional. The Client Secret of this relying party application (in Azure Active Directory, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Optional. The Client Secret of this relying party application (in Microsoft Entra ID, this is also referred to as the Key). This setting is optional. If no client secret is configured, the OpenID Connect implicit auth flow is used to authenticate end users. Otherwise, the OpenID Connect Authorization Code Flow is used to authenticate end users. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateThumbprint": { @@ -97355,7 +97355,7 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://sts.windows.net/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } }, "microsoftAccountClientId": { @@ -97654,14 +97654,14 @@ "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Set to `false` if the Azure Active Directory provider should not be enabled despite the set registration." + "description": "Optional. Set to `false` if the Microsoft Entra ID provider should not be enabled despite the set registration." } }, "isAutoProvisioned": { "type": "bool", "nullable": true, "metadata": { - "description": "Optional. Gets a value indicating whether the Azure AD configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." + "description": "Optional. Gets a value indicating whether the Microsoft Entra ID configuration was auto-provisioned using 1st party tooling. This is an internal flag primarily intended to support the Azure Management Portal. Users should not read or write to this property." } }, "login": { @@ -97687,7 +97687,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory login flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID login flow." } }, "registration": { @@ -97696,7 +97696,7 @@ "clientId": { "type": "string", "metadata": { - "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Azure Active Directory or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." + "description": "Required. The Client ID of this relying party application, known as the client_id. This setting is required for enabling OpenID Connection authentication with Microsoft Entra ID or other 3rd party OpenID Connect providers. More information on [OpenID Connect](http://openid.net/specs/openid-connect-core-1_0.html)." } }, "clientSecretCertificateIssuer": { @@ -97731,13 +97731,13 @@ "type": "string", "nullable": true, "metadata": { - "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Azure Active Directory, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." + "description": "Optional. The OpenID Connect Issuer URI that represents the entity which issues access tokens for this application. When using Microsoft Entra ID, this value is the URI of the directory tenant, e.g. https://login.microsoftonline.com/v2.0/{tenant-guid}/. This URI is a case-sensitive identifier for the token issuer. More information on [OpenID Connect Discovery](http://openid.net/specs/openid-connect-discovery-1_0.html)." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory app registration." + "description": "Optional. The configuration settings of the Microsoft Entra ID app registration." } }, "validation": { @@ -97763,7 +97763,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed applications." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed applications." } }, "allowedPrincipals": { @@ -97792,7 +97792,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory allowed principals." + "description": "Optional. The configuration settings of the Microsoft Entra ID allowed principals." } } }, @@ -97833,13 +97833,13 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active directory provider." + "description": "Optional. The configuration settings of the Microsoft Entra ID provider." } }, "azureStaticWebApps": { @@ -98192,7 +98192,7 @@ }, "nullable": true, "metadata": { - "description": "Optional. The configuration settings of the Azure Active Directory token validation flow." + "description": "Optional. The configuration settings of the Microsoft Entra ID token validation flow." } } }, @@ -105854,7 +105854,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Principal ID of the AI Search identity." + "description": "Principal ID of the Azure AI Search identity." } }, "appServicePrincipalIds": { @@ -105868,28 +105868,28 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Principal ID of the deploying user (for deployer Cosmos DB access)." + "description": "Principal ID of the deploying user (for deployer Azure Cosmos DB access)." } }, "aiFoundryResourceId": { "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Foundry account (empty if not deployed β€” new project path)." + "description": "Resource ID of the Azure AI Foundry account (empty if not deployed β€” new project path)." } }, "aiSearchResourceId": { "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Search service (empty if not deployed)." + "description": "Resource ID of the Azure AI Search service (empty if not deployed)." } }, "cosmosDbAccountName": { "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the Cosmos DB account (empty if not deployed)." + "description": "Name of the Azure Cosmos DB account (empty if not deployed)." } } }, @@ -106083,7 +106083,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." + "description": "Name of the target Azure AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." } }, "containerRegistryName": { @@ -106205,7 +106205,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." + "description": "Name of the target Azure AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." } }, "containerRegistryName": { @@ -106311,70 +106311,70 @@ "AZURE_COSMOSDB_ACCOUNT": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[reference('cosmosDBModule').outputs.name.value]" }, "COSMOS_DB_ENDPOINT": { "type": "string", "metadata": { - "description": "Cosmos DB endpoint URL." + "description": "Azure Cosmos DB endpoint URL." }, "value": "[reference('cosmosDBModule').outputs.endpoint.value]" }, "COSMOS_DB_DATABASE_NAME": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database." + "description": "Name of the Azure Cosmos DB database." }, "value": "[reference('cosmosDBModule').outputs.databaseName.value]" }, "AZURE_COSMOSDB_CONVERSATIONS_CONTAINER": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB container for chat conversations." + "description": "Name of the Azure Cosmos DB container for chat conversations." }, "value": "chat_sessions" }, "AZURE_COSMOSDB_DATABASE": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database (alias)." + "description": "Name of the Azure Cosmos DB database (alias)." }, "value": "[reference('cosmosDBModule').outputs.databaseName.value]" }, "AZURE_OPENAI_DEPLOYMENT_MODEL": { "type": "string", "metadata": { - "description": "Azure OpenAI GPT model deployment name." + "description": "OpenAI GPT model deployment name." }, "value": "[parameters('gptModelName')]" }, "AZURE_OPENAI_EMBEDDING_MODEL": { "type": "string", "metadata": { - "description": "Azure OpenAI embedding model name." + "description": "OpenAI embedding model name." }, "value": "[parameters('embeddingModel')]" }, "AZURE_OPENAI_EMBEDDING_MODEL_CAPACITY": { "type": "int", "metadata": { - "description": "Azure OpenAI embedding model deployment capacity." + "description": "OpenAI embedding model deployment capacity." }, "value": "[parameters('embeddingDeploymentCapacity')]" }, "AZURE_OPENAI_ENDPOINT": { "type": "string", "metadata": { - "description": "Azure OpenAI service endpoint URL." + "description": "OpenAI service endpoint URL." }, "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.endpoint.value, reference('ai_foundry_project').outputs.endpoint.value)]" }, "AZURE_OPENAI_MODEL_DEPLOYMENT_TYPE": { "type": "string", "metadata": { - "description": "Azure OpenAI model deployment type." + "description": "OpenAI model deployment type." }, "value": "[parameters('deploymentType')]" }, @@ -106388,14 +106388,14 @@ "AZURE_OPENAI_API_VERSION": { "type": "string", "metadata": { - "description": "API version for Azure OpenAI service." + "description": "API version for OpenAI service." }, "value": "[parameters('azureOpenaiAPIVersion')]" }, "AZURE_OPENAI_RESOURCE": { "type": "string", "metadata": { - "description": "Name of the Azure OpenAI resource." + "description": "Name of the OpenAI resource." }, "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.name.value, reference('ai_foundry_project').outputs.name.value)]" }, diff --git a/infra/avm/modules/ai/ai-foundry-connection.bicep b/infra/avm/modules/ai/ai-foundry-connection.bicep index 443de377..6bbcadb4 100644 --- a/infra/avm/modules/ai/ai-foundry-connection.bicep +++ b/infra/avm/modules/ai/ai-foundry-connection.bicep @@ -1,6 +1,6 @@ // ============================================================================ -// Module: AI Foundry Project Connection (Single) -// Description: Creates a single connection on an AI Foundry project. +// Module: Azure AI Foundry Project Connection (Single) +// Description: Creates a single connection on an Azure AI Foundry project. // Generic, reusable β€” call once per connection type from main.bicep. // Supports any connection category (CognitiveSearch, AzureBlob, // AppInsights, RemoteTool, etc.) via parameterized properties. @@ -11,7 +11,7 @@ targetScope = 'resourceGroup' @description('Required. Name of the parent AI Services account.') param aiServicesAccountName string -@description('Required. Name of the AI Foundry project.') +@description('Required. Name of the Azure AI Foundry project.') param projectName string @description('Required. Solution name suffix used to generate the connection name.') diff --git a/infra/avm/modules/ai/ai-foundry-project.bicep b/infra/avm/modules/ai/ai-foundry-project.bicep index d718244c..231ab5ea 100644 --- a/infra/avm/modules/ai/ai-foundry-project.bicep +++ b/infra/avm/modules/ai/ai-foundry-project.bicep @@ -1,7 +1,7 @@ // ============================================================================ -// Module: AI Foundry Project (Account + Project) +// Module: Azure AI Foundry Project (Account + Project) // Description: AVM wrapper for Azure AI Services account creation and -// AI Foundry project provisioning. Generic, reusable across GSAs. +// Azure AI Foundry project provisioning. Generic, reusable across GSAs. // AVM Module: avm/res/cognitive-services/account // WAF: https://learn.microsoft.com/azure/well-architected/service-guides/azure-openai // ============================================================================ @@ -12,7 +12,7 @@ param solutionName string @description('Optional. Override name for the AI Services account. Defaults to aif-{solutionName}.') param name string = 'aif-${solutionName}' -@description('Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}.') +@description('Optional. Override name for the Azure AI Foundry project. Defaults to proj-{solutionName}.') param projectName string = 'proj-${solutionName}' @description('Required. Azure region for the resources.') @@ -27,7 +27,7 @@ param skuName string = 'S0' @description('Optional. Whether to disable local (key-based) authentication.') param disableLocalAuth bool = true -@description('Optional. Whether to allow project management (AI Foundry hub).') +@description('Optional. Whether to allow project management (Azure AI Foundry hub).') param allowProjectManagement bool = true @description('Optional. Public network access setting.') @@ -86,7 +86,7 @@ module aiServicesAccount 'br/public:avm/res/cognitive-services/account:0.14.2' = } // ============================================================================ -// AI Foundry Project +// Azure AI Foundry Project // ============================================================================ resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' existing = { name: name @@ -126,13 +126,13 @@ output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content U @description('System-assigned identity principal ID of the AI Services account.') output principalId string = aiServices.identity.principalId -@description('Resource ID of the AI Foundry project.') +@description('Resource ID of the Azure AI Foundry project.') output projectResourceId string = aiProject.id -@description('Name of the AI Foundry project.') +@description('Name of the Azure AI Foundry project.') output projectName string = aiProject.name -@description('AI Foundry project endpoint.') +@description('Azure AI Foundry project endpoint.') output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API'] @description('System-assigned identity principal ID of the project.') diff --git a/infra/avm/modules/ai/ai-search.bicep b/infra/avm/modules/ai/ai-search.bicep index e0ffda10..949616fc 100644 --- a/infra/avm/modules/ai/ai-search.bicep +++ b/infra/avm/modules/ai/ai-search.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: AI Search +// Module: Azure AI Search // Description: Deploys Azure AI Search with a two-step pattern: // Step 1: Plain Bicep resource for fast initial creation (name, location, SKU) // Step 2: AVM module update to enable managed identity & full configuration @@ -69,7 +69,7 @@ import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-co param privateEndpoints privateEndpointSingleServiceType[]? // --- Role Assignments --- -@description('Optional. Array of role assignments to create on the AI Search service.') +@description('Optional. Array of role assignments to create on the Azure AI Search service.') param roleAssignments array = [] // ============================================================================ @@ -115,13 +115,13 @@ module searchServiceUpdate 'br/public:avm/res/search/search-service:0.12.0' = { // ============================================================================ // Outputs // ============================================================================ -@description('Resource ID of the AI Search service.') +@description('Resource ID of the Azure AI Search service.') output resourceId string = searchService.id -@description('Name of the AI Search service.') +@description('Name of the Azure AI Search service.') output name string = searchService.name -@description('Endpoint URL of the AI Search service.') +@description('Endpoint URL of the Azure AI Search service.') output endpoint string = 'https://${searchService.name}.search.windows.net' @description('System-assigned identity principal ID.') diff --git a/infra/avm/modules/ai/existing-project-setup.bicep b/infra/avm/modules/ai/existing-project-setup.bicep index cd0fe1f2..43a5a44d 100644 --- a/infra/avm/modules/ai/existing-project-setup.bicep +++ b/infra/avm/modules/ai/existing-project-setup.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: Existing AI Foundry Project Reference +// Module: Existing Azure AI Foundry Project Reference // Description: References an existing AI Services account and project to // retrieve their identities. No deployments, no connections. // Use generic ai-foundry-connection and ai-foundry-model-deployment @@ -46,13 +46,13 @@ output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content U @description('System-assigned identity principal ID of the AI Services account (empty if none).') output principalId string = aiServices.identity.?principalId ?? '' -@description('Resource ID of the AI Foundry project.') +@description('Resource ID of the Azure AI Foundry project.') output projectResourceId string = aiProject.id -@description('Name of the AI Foundry project.') +@description('Name of the Azure AI Foundry project.') output projectName string = aiProject.name -@description('AI Foundry project endpoint.') +@description('Azure AI Foundry project endpoint.') output projectEndpoint string = aiProject.properties.endpoints['AI Foundry API'] @description('System-assigned identity principal ID of the project (empty if none).') diff --git a/infra/avm/modules/compute/container-registry.bicep b/infra/avm/modules/compute/container-registry.bicep index ed12847c..42f63dcf 100644 --- a/infra/avm/modules/compute/container-registry.bicep +++ b/infra/avm/modules/compute/container-registry.bicep @@ -54,7 +54,7 @@ param enableTelemetry bool = true @description('Optional. Managed identities for the resource.') param managedIdentities object = { systemAssigned: true } -@description('Azure AD authentication as ARM policy status.') +@description('Microsoft Entra ID authentication as ARM policy status.') param azureADAuthenticationAsArmPolicyStatus string = 'enabled' // ============================================================================ diff --git a/infra/avm/modules/data/cosmos-db-mongo.bicep b/infra/avm/modules/data/cosmos-db-mongo.bicep index c2f05ffe..64b479a6 100644 --- a/infra/avm/modules/data/cosmos-db-mongo.bicep +++ b/infra/avm/modules/data/cosmos-db-mongo.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: Cosmos DB (MongoDB) +// Module: Azure Cosmos DB (MongoDB) // Description: AVM wrapper for Azure Cosmos DB with MongoDB API // AVM Module: avm/res/document-db/database-account:0.19.0 // WAF: https://learn.microsoft.com/azure/well-architected/service-guides/cosmos-db @@ -8,7 +8,7 @@ @description('Solution name suffix used to derive the resource name.') param solutionName string -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') param name string = 'cosmos-${solutionName}' @description('Azure region for the resource.') @@ -105,17 +105,17 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.19.0' = { // ============================================================================ // Outputs // ============================================================================ -@description('Resource ID of the Cosmos DB account.') +@description('Resource ID of the Azure Cosmos DB account.') output resourceId string = cosmosAccount.outputs.resourceId -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') output name string = cosmosAccount.outputs.name @secure() @description('MongoDB connection string (without credentials β€” use Key Vault for secrets).') output connectionString string = cosmosAccount.outputs.primaryReadWriteConnectionString -@description('Endpoint of the Cosmos DB account.') +@description('Endpoint of the Azure Cosmos DB account.') output endpoint string = 'https://${name}.mongo.cosmos.azure.com:443/' @description('Database name.') diff --git a/infra/avm/modules/data/cosmos-db-nosql.bicep b/infra/avm/modules/data/cosmos-db-nosql.bicep index 56d78644..c7e48781 100644 --- a/infra/avm/modules/data/cosmos-db-nosql.bicep +++ b/infra/avm/modules/data/cosmos-db-nosql.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: Cosmos DB +// Module: Azure Cosmos DB // Description: AVM wrapper for Azure Cosmos DB (NoSQL) with WAF alignment // AVM Module: avm/res/document-db/database-account:0.19.0 // WAF: https://learn.microsoft.com/azure/well-architected/service-guides/cosmos-db @@ -8,7 +8,7 @@ @description('Solution name suffix used to derive the resource name.') param solutionName string -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') param name string = 'cosmos-${solutionName}' @description('Azure region for the resource.') @@ -21,7 +21,10 @@ param tags object = {} param databaseName string = 'db_conversation_history' @description('Container definitions.') -param containers array = [ +param containers { + name: string + partitionKeyPath: string +}[] = [ { name: 'conversations' partitionKeyPath: '/userId' @@ -41,7 +44,7 @@ param publicNetworkAccess string = 'Enabled' import { privateEndpointSingleServiceType } from 'br/public:avm/utl/types/avm-common-types:0.5.1' @description('Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.') -param privateEndpoints privateEndpointSingleServiceType[]? +param privateEndpoints privateEndpointSingleServiceType[] = [] // --- WAF: Redundancy --- @description('Enable zone redundancy.') @@ -84,7 +87,7 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.19.0' = { networkAclBypass: 'None' publicNetworkAccess: publicNetworkAccess } - privateEndpoints: privateEndpoints + privateEndpoints: any(privateEndpoints) zoneRedundant: zoneRedundant enableAutomaticFailover: enableAutomaticFailover managedIdentities: managedIdentities @@ -114,13 +117,13 @@ module cosmosAccount 'br/public:avm/res/document-db/database-account:0.19.0' = { // ============================================================================ // Outputs // ============================================================================ -@description('Resource ID of the Cosmos DB account.') +@description('Resource ID of the Azure Cosmos DB account.') output resourceId string = cosmosAccount.outputs.resourceId -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') output name string = cosmosAccount.outputs.name -@description('Endpoint of the Cosmos DB account.') +@description('Endpoint of the Azure Cosmos DB account.') output endpoint string = 'https://${name}.documents.azure.com:443/' @description('Database name.') diff --git a/infra/avm/modules/data/postgresql-flexible-server.bicep b/infra/avm/modules/data/postgresql-flexible-server.bicep index b68631a9..6f48a680 100644 --- a/infra/avm/modules/data/postgresql-flexible-server.bicep +++ b/infra/avm/modules/data/postgresql-flexible-server.bicep @@ -20,7 +20,7 @@ param tags object = {} @description('Optional. Enable/Disable usage telemetry for module.') param enableTelemetry bool = true -@description('Azure AD administrators for the server. Each entry requires objectId, principalName, and principalType (User, Group, or ServicePrincipal).') +@description('Microsoft Entra ID administrators for the server. Each entry requires objectId, principalName, and principalType (User, Group, or ServicePrincipal).') param administrators array @description('The PostgreSQL version to deploy.') diff --git a/infra/avm/modules/identity/cross-scope-role-assignment.bicep b/infra/avm/modules/identity/cross-scope-role-assignment.bicep index e0f55cf9..824d5217 100644 --- a/infra/avm/modules/identity/cross-scope-role-assignment.bicep +++ b/infra/avm/modules/identity/cross-scope-role-assignment.bicep @@ -22,7 +22,7 @@ param principalType string = 'ServicePrincipal' @allowed(['AIServices', 'ContainerRegistry']) param targetResourceType string = 'AIServices' -@description('Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices.') +@description('Name of the target Azure AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices.') param aiFoundryName string = '' @description('Name of the target Azure Container Registry. Required when targetResourceType is ContainerRegistry.') diff --git a/infra/avm/modules/identity/role-assignments.bicep b/infra/avm/modules/identity/role-assignments.bicep index c50e1858..dc216467 100644 --- a/infra/avm/modules/identity/role-assignments.bicep +++ b/infra/avm/modules/identity/role-assignments.bicep @@ -24,24 +24,24 @@ param existingFoundryProjectResourceId string = '' @description('Principal ID of the AI project identity (works for both new and existing projects).') param aiProjectPrincipalId string = '' -@description('Principal ID of the AI Search identity.') +@description('Principal ID of the Azure AI Search identity.') param aiSearchPrincipalId string = '' @description('Principal IDs of the App Service system-assigned identities (empty if not deployed).') param appServicePrincipalIds object = {} -@description('Principal ID of the deploying user (for deployer Cosmos DB access).') +@description('Principal ID of the deploying user (for deployer Azure Cosmos DB access).') param deployerPrincipalId string = '' // --- Resource References --- -@description('Resource ID of the AI Foundry account (empty if not deployed β€” new project path).') +@description('Resource ID of the Azure AI Foundry account (empty if not deployed β€” new project path).') param aiFoundryResourceId string = '' -@description('Resource ID of the AI Search service (empty if not deployed).') +@description('Resource ID of the Azure AI Search service (empty if not deployed).') param aiSearchResourceId string = '' -@description('Name of the Cosmos DB account (empty if not deployed).') +@description('Name of the Azure Cosmos DB account (empty if not deployed).') param cosmosDbAccountName string = '' // ============================================================================ @@ -84,15 +84,15 @@ resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' existi resource cosmosContributorRoleDefinition 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2025-10-15' existing = if (!empty(cosmosDbAccountName)) { parent: cosmosAccount - name: '00000000-0000-0000-0000-000000000002' // Cosmos DB Built-in Data Contributor + name: '00000000-0000-0000-0000-000000000002' // Azure Cosmos DB Built-in Data Contributor } // ============================================================================ // 1. AI SERVICES ROLE ASSIGNMENTS -// Cross-service roles scoped to AI Foundry account +// Cross-service roles scoped to Azure AI Foundry account // ============================================================================ -// AI Search β†’ Cognitive Services OpenAI User on AI Foundry (new project, same RG) +// Azure AI Search β†’ Cognitive Services Azure OpenAI User on Azure AI Foundry (new project, same RG) resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiSearchPrincipalId) && !empty(aiFoundryResourceId)) { name: guid(solutionName, aiFoundryAccount.id, aiSearchPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser) scope: aiFoundryAccount @@ -103,7 +103,7 @@ resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@202 } } -// AI Search β†’ Cognitive Services OpenAI User on existing AI Foundry (cross-scope) +// Azure AI Search β†’ Cognitive Services Azure OpenAI User on existing Azure AI Foundry (cross-scope) module assignOpenAIToSearchExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(aiSearchPrincipalId)) { name: 'assignOpenAIRoleToAISearchExisting' scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup) @@ -115,7 +115,7 @@ module assignOpenAIToSearchExisting './cross-scope-role-assignment.bicep' = if ( } } -// Chat Backend App Service β†’ Cognitive Services User on AI Foundry (new project β€” required for Voice Live and agents) +// Chat Backend App Service β†’ Cognitive Services User on Azure AI Foundry (new project β€” required for Voice Live and agents) resource chatBackendAppCogServicesUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiFoundryResourceId) && !empty(appServicePrincipalIds.chatBackendApp)) { name: guid(solutionName, aiFoundryAccount.id, appServicePrincipalIds.chatBackendApp, roleDefinitions.cognitiveServicesUser) scope: aiFoundryAccount @@ -126,7 +126,7 @@ resource chatBackendAppCogServicesUserAssignment 'Microsoft.Authorization/roleAs } } -// Chat Backend App Service β†’ Cognitive Services User on existing AI Foundry (cross-scope β€” Voice Live and agents) +// Chat Backend App Service β†’ Cognitive Services User on existing Azure AI Foundry (cross-scope β€” Voice Live and agents) module chatBackendAppCogServicesUserExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(appServicePrincipalIds.chatBackendApp)) { name: 'assignCogServicesUserRoleToChatBackendExisting' scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup) @@ -140,10 +140,10 @@ module chatBackendAppCogServicesUserExisting './cross-scope-role-assignment.bice // ============================================================================ // 2. SEARCH SERVICE ROLE ASSIGNMENTS -// AI Project and Backend identities β†’ AI Search +// AI Project and Backend identities β†’ Azure AI Search // ============================================================================ -// AI Project β†’ Search Index Data Reader on AI Search +// AI Project β†’ Search Index Data Reader on Azure AI Search resource projectSearchReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) { name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchIndexDataReader) scope: aiSearchService @@ -154,7 +154,7 @@ resource projectSearchReader 'Microsoft.Authorization/roleAssignments@2022-04-01 } } -// AI Project β†’ Search Service Contributor on AI Search +// AI Project β†’ Search Service Contributor on Azure AI Search resource projectSearchContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) { name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchServiceContributor) scope: aiSearchService @@ -165,7 +165,7 @@ resource projectSearchContributor 'Microsoft.Authorization/roleAssignments@2022- } } -// Chat Backend App Service β†’ Search Index Data Contributor on AI Search +// Chat Backend App Service β†’ Search Index Data Contributor on Azure AI Search resource chatBackendAppSearchContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(appServicePrincipalIds.chatBackendApp)) { name: guid(solutionName, aiSearchService.id, appServicePrincipalIds.chatBackendApp, roleDefinitions.searchIndexDataContributor) scope: aiSearchService @@ -177,8 +177,8 @@ resource chatBackendAppSearchContributorAssignment 'Microsoft.Authorization/role } // ============================================================================ -// 3. COSMOS DB ROLE ASSIGNMENTS -// Backend App Service β†’ Cosmos DB (data-plane, uses sqlRoleAssignments) +// 3. Azure Cosmos DB ROLE ASSIGNMENTS +// Backend App Service β†’ Azure Cosmos DB (data-plane, uses sqlRoleAssignments) // ============================================================================ resource chatBackendAppCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2025-10-15' = if (!empty(cosmosDbAccountName) && !empty(appServicePrincipalIds.chatBackendApp)) { @@ -203,12 +203,12 @@ resource scenarioBackendAppCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAc // ============================================================================ // 4. DEPLOYER (USER) ROLE ASSIGNMENTS -// Deploying user β†’ Cosmos DB +// Deploying user β†’ Azure Cosmos DB // ============================================================================ -// Deploying User β†’ Cosmos DB Data Contributor (required for post-deploy data upload scripts) +// Deploying User β†’ Azure Cosmos DB Data Contributor (required for post-deploy data upload scripts) resource deployerCosmosDbContributor 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2025-10-15' = if (!empty(cosmosDbAccountName) && !empty(deployerPrincipalId)) { parent: cosmosAccount name: guid(solutionName, cosmosContributorRoleDefinition.id, cosmosAccount.id, deployerPrincipalId) diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep index c6c9aa2c..626d99e4 100644 --- a/infra/bicep/main.bicep +++ b/infra/bicep/main.bicep @@ -58,7 +58,7 @@ param tags object = {} ] } }) -@description('Required. Location for AI Foundry and model deployments.') +@description('Required. Location for Azure AI Foundry and model deployments.') param azureAiServiceLocation string @description('Deployment scenario: ecommerce, healthcare, or banking') @@ -113,7 +113,7 @@ param gptRealtimeModelVersion string = '2025-12-15' @description('Optional. Capacity of the realtime model deployment.') param gptRealtimeDeploymentCapacity int = 1 -@description('Optional. Azure OpenAI API version.') +@description('Optional. OpenAI API version.') param azureOpenaiAPIVersion string = '2025-01-01-preview' @description('Optional. Azure AI Agent API version.') @@ -141,7 +141,7 @@ param enableMonitoring bool = false @description('Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one when monitoring is enabled.') param existingLogAnalyticsWorkspaceId string = '' -@description('Optional. Resource ID of an existing AI Foundry project. Empty creates a new one.') +@description('Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one.') param existingFoundryProjectResourceId string = '' // ============================================================================ @@ -679,19 +679,19 @@ output AZURE_AI_AGENT_API_VERSION string = azureAiAgentApiVersion @description('Name of the Azure AI Foundry project.') output AZURE_AI_PROJECT_NAME string = aiProjectName -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') output AZURE_COSMOSDB_ACCOUNT string = cosmosDBModule.outputs.name -@description('Cosmos DB endpoint URL.') +@description('Azure Cosmos DB endpoint URL.') output COSMOS_DB_ENDPOINT string = cosmosDBModule.outputs.endpoint -@description('Name of the Cosmos DB database.') +@description('Name of the Azure Cosmos DB database.') output COSMOS_DB_DATABASE_NAME string = cosmosDBModule.outputs.databaseName -@description('Name of the Cosmos DB container for chat conversations.') +@description('Name of the Azure Cosmos DB container for chat conversations.') output AZURE_COSMOSDB_CONVERSATIONS_CONTAINER string = 'chat_sessions' -@description('Name of the Cosmos DB database (alias).') +@description('Name of the Azure Cosmos DB database (alias).') output AZURE_COSMOSDB_DATABASE string = cosmosDBModule.outputs.databaseName @description('Azure OpenAI GPT model deployment name.') diff --git a/infra/bicep/main.json b/infra/bicep/main.json index 30f0e713..8b4a6872 100644 --- a/infra/bicep/main.json +++ b/infra/bicep/main.json @@ -70,7 +70,7 @@ "OpenAI.GlobalStandard.gpt-realtime-mini,1" ] }, - "description": "Required. Location for AI Foundry and model deployments." + "description": "Required. Location for Azure AI Foundry and model deployments." } }, "deploymentScenario": { @@ -165,7 +165,7 @@ "type": "string", "defaultValue": "2025-01-01-preview", "metadata": { - "description": "Optional. Azure OpenAI API version." + "description": "Optional. OpenAI API version." } }, "azureAiAgentApiVersion": { @@ -215,7 +215,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one." + "description": "Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one." } }, "deployingUserPrincipalType": { @@ -636,7 +636,7 @@ "type": "string", "defaultValue": "[format('proj-{0}', parameters('solutionName'))]", "metadata": { - "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}." + "description": "Optional. Override name for the Azure AI Foundry project. Defaults to proj-{solutionName}." } }, "location": { @@ -670,7 +670,7 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "Optional. Whether to allow project management (AI Foundry hub)." + "description": "Optional. Whether to allow project management (Azure AI Foundry hub)." } }, "publicNetworkAccess": { @@ -770,7 +770,7 @@ "azureOpenAiCuEndpoint": { "type": "string", "metadata": { - "description": "Azure OpenAI Content Understanding endpoint URL." + "description": "OpenAI Content Understanding endpoint URL." }, "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]" }, @@ -784,23 +784,23 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, "projectEndpoint": { "type": "string", "metadata": { - "description": "AI Foundry project endpoint." + "description": "Azure AI Foundry project endpoint." }, - "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]" + "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['Azure AI Foundry API']]" }, "projectIdentityPrincipalId": { "type": "string", @@ -890,7 +890,7 @@ "azureOpenAiCuEndpoint": { "type": "string", "metadata": { - "description": "Azure OpenAI Content Understanding endpoint URL." + "description": "OpenAI Content Understanding endpoint URL." }, "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]" }, @@ -904,23 +904,23 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, "projectEndpoint": { "type": "string", "metadata": { - "description": "AI Foundry project endpoint." + "description": "Azure AI Foundry project endpoint." }, - "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]" + "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['Azure AI Foundry API']]" }, "projectIdentityPrincipalId": { "type": "string", @@ -1312,7 +1312,7 @@ "name": { "type": "string", "metadata": { - "description": "The name of the existing AI Search service." + "description": "The name of the existing Azure AI Search service." } }, "location": { @@ -1432,7 +1432,7 @@ "systemAssignedMIPrincipalId": { "type": "string", "metadata": { - "description": "The principal ID of the AI Search system-assigned managed identity." + "description": "The principal ID of the Azure AI Search system-assigned managed identity." }, "value": "[reference(resourceId('Microsoft.Search/searchServices', parameters('name')), '2025-05-01', 'full').identity.principalId]" } @@ -1448,21 +1448,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Search service." + "description": "Resource ID of the Azure AI Search service." }, "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]" }, "name": { "type": "string", "metadata": { - "description": "Name of the AI Search service." + "description": "Name of the Azure AI Search service." }, "value": "[parameters('name')]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint URL of the AI Search service." + "description": "Endpoint URL of the Azure AI Search service." }, "value": "[format('https://{0}.search.windows.net', parameters('name'))]" }, @@ -1533,7 +1533,7 @@ "projectName": { "type": "string", "metadata": { - "description": "Required. Name of the AI Foundry project." + "description": "Required. Name of the Azure AI Foundry project." } }, "solutionName": { @@ -1716,7 +1716,7 @@ "type": "string", "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." } }, "location": { @@ -1833,21 +1833,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the Cosmos DB account." + "description": "Resource ID of the Azure Cosmos DB account." }, "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" }, "name": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[parameters('name')]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint of the Cosmos DB account." + "description": "Endpoint of the Azure Cosmos DB account." }, "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]" }, @@ -3620,7 +3620,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Principal ID of the AI Search identity." + "description": "Principal ID of the Azure AI Search identity." } }, "appServicePrincipalIds": { @@ -3652,21 +3652,21 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Foundry account (empty if not deployed β€” new project path)." + "description": "Resource ID of the Azure AI Foundry account (empty if not deployed β€” new project path)." } }, "aiSearchResourceId": { "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Search service (empty if not deployed)." + "description": "Resource ID of the Azure AI Search service (empty if not deployed)." } }, "cosmosDbAccountName": { "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the Cosmos DB account (empty if not deployed)." + "description": "Name of the Azure Cosmos DB account (empty if not deployed)." } }, "containerRegistryResourceId": { @@ -4207,70 +4207,70 @@ "AZURE_COSMOSDB_ACCOUNT": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]" }, "COSMOS_DB_ENDPOINT": { "type": "string", "metadata": { - "description": "Cosmos DB endpoint URL." + "description": "Azure Cosmos DB endpoint URL." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]" }, "COSMOS_DB_DATABASE_NAME": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database." + "description": "Name of the Azure Cosmos DB database." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]" }, "AZURE_COSMOSDB_CONVERSATIONS_CONTAINER": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB container for chat conversations." + "description": "Name of the Azure Cosmos DB container for chat conversations." }, "value": "chat_sessions" }, "AZURE_COSMOSDB_DATABASE": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database (alias)." + "description": "Name of the Azure Cosmos DB database (alias)." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]" }, "AZURE_OPENAI_DEPLOYMENT_MODEL": { "type": "string", "metadata": { - "description": "Azure OpenAI GPT model deployment name." + "description": "OpenAI GPT model deployment name." }, "value": "[parameters('gptModelName')]" }, "AZURE_OPENAI_EMBEDDING_MODEL": { "type": "string", "metadata": { - "description": "Azure OpenAI embedding model name." + "description": "OpenAI embedding model name." }, "value": "[parameters('embeddingModel')]" }, "AZURE_OPENAI_EMBEDDING_MODEL_CAPACITY": { "type": "int", "metadata": { - "description": "Azure OpenAI embedding model deployment capacity." + "description": "OpenAI embedding model deployment capacity." }, "value": "[parameters('embeddingDeploymentCapacity')]" }, "AZURE_OPENAI_ENDPOINT": { "type": "string", "metadata": { - "description": "Azure OpenAI service endpoint URL." + "description": "OpenAI service endpoint URL." }, "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value)]" }, "AZURE_OPENAI_MODEL_DEPLOYMENT_TYPE": { "type": "string", "metadata": { - "description": "Azure OpenAI model deployment type." + "description": "OpenAI model deployment type." }, "value": "[parameters('deploymentType')]" }, @@ -4284,14 +4284,14 @@ "AZURE_OPENAI_API_VERSION": { "type": "string", "metadata": { - "description": "API version for Azure OpenAI service." + "description": "API version for OpenAI service." }, "value": "[parameters('azureOpenaiAPIVersion')]" }, "AZURE_OPENAI_RESOURCE": { "type": "string", "metadata": { - "description": "Name of the Azure OpenAI resource." + "description": "Name of the OpenAI resource." }, "value": "[if(variables('useExistingAIProject'), reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('aiFoundrySubscriptionId'), variables('aiFoundryResourceGroupName')), 'Microsoft.Resources/deployments', take(format('module.existing-project-setup.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value, reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.ai-foundry-project.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value)]" }, diff --git a/infra/bicep/modules/ai/ai-foundry-connection.bicep b/infra/bicep/modules/ai/ai-foundry-connection.bicep index 6649b5f7..47152564 100644 --- a/infra/bicep/modules/ai/ai-foundry-connection.bicep +++ b/infra/bicep/modules/ai/ai-foundry-connection.bicep @@ -1,6 +1,6 @@ // ============================================================================ -// Module: AI Foundry Project Connection (Single) β€” Vanilla Bicep -// Description: Creates a single connection on an AI Foundry project. +// Module: Azure AI Foundry Project Connection (Single) β€” Vanilla Bicep +// Description: Creates a single connection on an Azure AI Foundry project. // Generic, reusable β€” call once per connection type from main.bicep. // Supports any connection category (CognitiveSearch, AzureBlob, // AppInsights, RemoteTool, etc.) via parameterized properties. @@ -11,7 +11,7 @@ targetScope = 'resourceGroup' @description('Required. Name of the parent AI Services account.') param aiServicesAccountName string -@description('Required. Name of the AI Foundry project.') +@description('Required. Name of the Azure AI Foundry project.') param projectName string @description('Required. Solution name suffix used to generate the connection name.') diff --git a/infra/bicep/modules/ai/ai-foundry-project.bicep b/infra/bicep/modules/ai/ai-foundry-project.bicep index 6eea3c12..c5618018 100644 --- a/infra/bicep/modules/ai/ai-foundry-project.bicep +++ b/infra/bicep/modules/ai/ai-foundry-project.bicep @@ -1,6 +1,6 @@ // ============================================================================ -// Module: AI Foundry Project (Account + Project) β€” Vanilla Bicep -// Description: Creates an Azure AI Services account and AI Foundry project. +// Module: Azure AI Foundry Project (Account + Project) β€” Vanilla Bicep +// Description: Creates an Azure AI Services account and Azure AI Foundry project. // Generic, reusable across GSAs β€” no app-specific parameters. // ============================================================================ @@ -12,7 +12,7 @@ param solutionName string @description('Optional. Override name for the AI Services account. Defaults to aif-{solutionName}.') param name string = 'aif-${solutionName}' -@description('Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}.') +@description('Optional. Override name for the Azure AI Foundry project. Defaults to proj-{solutionName}.') param projectName string = 'proj-${solutionName}' @description('Required. Azure region for the resources.') @@ -27,7 +27,7 @@ param skuName string = 'S0' @description('Optional. Whether to disable local (key-based) authentication.') param disableLocalAuth bool = true -@description('Optional. Whether to allow project management (AI Foundry hub).') +@description('Optional. Whether to allow project management (Azure AI Foundry hub).') param allowProjectManagement bool = true @description('Optional. Public network access setting.') @@ -66,7 +66,7 @@ resource aiServices 'Microsoft.CognitiveServices/accounts@2025-12-01' = { } // ============================================================================ -// AI Foundry Project +// Azure AI Foundry Project // ============================================================================ resource aiProject 'Microsoft.CognitiveServices/accounts/projects@2025-12-01' = { parent: aiServices @@ -93,16 +93,16 @@ output endpoint string = aiServices.properties.endpoints['OpenAI Language Model @description('Endpoint of the AI Services account (Cognitive Services).') output cognitiveServicesEndpoint string = aiServices.properties.endpoint -@description('Azure OpenAI Content Understanding endpoint URL.') +@description('OpenAI Content Understanding endpoint URL.') output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content Understanding'] @description('System-assigned identity principal ID of the AI Services account.') output principalId string = aiServices.identity.principalId -@description('Resource ID of the AI Foundry project.') +@description('Resource ID of the Azure AI Foundry project.') output projectResourceId string = aiProject.id -@description('Name of the AI Foundry project.') +@description('Name of the Azure AI Foundry project.') output projectName string = aiProject.name @description('AI Foundry project endpoint.') diff --git a/infra/bicep/modules/ai/ai-search-identity.bicep b/infra/bicep/modules/ai/ai-search-identity.bicep index b85729b1..afbb5ac9 100644 --- a/infra/bicep/modules/ai/ai-search-identity.bicep +++ b/infra/bicep/modules/ai/ai-search-identity.bicep @@ -1,13 +1,13 @@ // ============================================================================ -// Module: AI Search Identity Update +// Module: Azure AI Search Identity Update // Description: Separate deployment that enables managed identity and applies -// full configuration on an existing AI Search service. +// full configuration on an existing Azure AI Search service. // Called by ai-search.bicep as Step 2 of the two-step pattern. // ============================================================================ targetScope = 'resourceGroup' -@description('The name of the existing AI Search service.') +@description('The name of the existing Azure AI Search service.') param name string @description('The Azure region of the search service.') @@ -67,5 +67,5 @@ resource searchServiceUpdate 'Microsoft.Search/searchServices@2025-05-01' = { } } -@description('The principal ID of the AI Search system-assigned managed identity.') +@description('The principal ID of the Azure AI Search system-assigned managed identity.') output systemAssignedMIPrincipalId string = searchServiceUpdate.identity.principalId diff --git a/infra/bicep/modules/ai/ai-search.bicep b/infra/bicep/modules/ai/ai-search.bicep index 84512c0c..34ef5258 100644 --- a/infra/bicep/modules/ai/ai-search.bicep +++ b/infra/bicep/modules/ai/ai-search.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: AI Search +// Module: Azure AI Search // Description: Deploys Azure AI Search with a two-step pattern: // Step 1: Plain Bicep resource for fast initial creation (name, location, SKU) // Step 2: Separate module deployment to enable managed identity & full config @@ -92,13 +92,13 @@ module searchServiceUpdate 'ai-search-identity.bicep' = { // Outputs // ============================================================================ -@description('Resource ID of the AI Search service.') +@description('Resource ID of the Azure AI Search service.') output resourceId string = aiSearch.id -@description('Name of the AI Search service.') +@description('Name of the Azure AI Search service.') output name string = aiSearch.name -@description('Endpoint URL of the AI Search service.') +@description('Endpoint URL of the Azure AI Search service.') output endpoint string = 'https://${aiSearch.name}.search.windows.net' @description('System-assigned identity principal ID.') diff --git a/infra/bicep/modules/ai/existing-project-setup.bicep b/infra/bicep/modules/ai/existing-project-setup.bicep index df0acdc5..12b8a1c4 100644 --- a/infra/bicep/modules/ai/existing-project-setup.bicep +++ b/infra/bicep/modules/ai/existing-project-setup.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: Existing AI Foundry Project Reference β€” Vanilla Bicep +// Module: Existing Azure AI Foundry Project Reference β€” Vanilla Bicep // Description: References an existing AI Services account and project to // retrieve their identities. No deployments, no connections. // Use generic ai-foundry-connection and ai-foundry-model-deployment @@ -41,16 +41,16 @@ output endpoint string = aiServices.properties.endpoints['OpenAI Language Model @description('Endpoint of the AI Services account (Cognitive Services).') output cognitiveServicesEndpoint string = aiServices.properties.endpoint -@description('Azure OpenAI Content Understanding endpoint URL.') +@description('OpenAI Content Understanding endpoint URL.') output azureOpenAiCuEndpoint string = aiServices.properties.endpoints['Content Understanding'] @description('System-assigned identity principal ID of the AI Services account (empty if none).') output principalId string = contains(aiServices, 'identity') && contains(aiServices.identity, 'principalId') ? aiServices.identity.principalId : '' -@description('Resource ID of the AI Foundry project.') +@description('Resource ID of the Azure AI Foundry project.') output projectResourceId string = aiProject.id -@description('Name of the AI Foundry project.') +@description('Name of the Azure AI Foundry project.') output projectName string = aiProject.name @description('AI Foundry project endpoint.') diff --git a/infra/bicep/modules/data/cosmos-db-mongo.bicep b/infra/bicep/modules/data/cosmos-db-mongo.bicep index 64b55b0b..b7948a4e 100644 --- a/infra/bicep/modules/data/cosmos-db-mongo.bicep +++ b/infra/bicep/modules/data/cosmos-db-mongo.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: Cosmos DB (MongoDB) +// Module: Azure Cosmos DB (MongoDB) // Description: Creates an Azure Cosmos DB account with MongoDB API // API: Microsoft.DocumentDB/databaseAccounts@2025-10-15 // ============================================================================ @@ -7,7 +7,7 @@ @description('Solution name suffix used to derive the resource name.') param solutionName string -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') param name string = 'cosmos-${solutionName}' @description('Azure region for the resource.') @@ -102,17 +102,17 @@ resource mongoCollections 'Microsoft.DocumentDB/databaseAccounts/mongodbDatabase // ============================================================================ // Outputs // ============================================================================ -@description('Resource ID of the Cosmos DB account.') +@description('Resource ID of the Azure Cosmos DB account.') output resourceId string = cosmos.id -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') output name string = cosmos.name @secure() @description('MongoDB connection string (without credentials β€” use Key Vault for secrets).') output connectionString string = cosmos.listConnectionStrings().connectionStrings[0].connectionString -@description('Endpoint of the Cosmos DB account.') +@description('Endpoint of the Azure Cosmos DB account.') output endpoint string = 'https://${name}.mongo.cosmos.azure.com:443/' @description('Database name.') diff --git a/infra/bicep/modules/data/cosmos-db-nosql.bicep b/infra/bicep/modules/data/cosmos-db-nosql.bicep index 631661d7..c1bbd9bd 100644 --- a/infra/bicep/modules/data/cosmos-db-nosql.bicep +++ b/infra/bicep/modules/data/cosmos-db-nosql.bicep @@ -1,5 +1,5 @@ // ============================================================================ -// Module: Cosmos DB +// Module: Azure Cosmos DB // Description: Creates an Azure Cosmos DB (NoSQL) account with database/container // API: Microsoft.DocumentDB/databaseAccounts@2025-10-15 // ============================================================================ @@ -7,7 +7,7 @@ @description('Solution name suffix used to derive the resource name.') param solutionName string -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') param name string = 'cosmos-${solutionName}' @description('Azure region for the resource.') @@ -20,7 +20,10 @@ param tags object = {} param databaseName string = 'db_conversation_history' @description('Container definitions.') -param containers array = [ +param containers { + name: string + partitionKeyPath: string +}[] = [ { name: 'conversations' partitionKeyPath: '/userId' @@ -78,13 +81,13 @@ resource database 'Microsoft.DocumentDB/databaseAccounts/sqlDatabases@2025-10-15 // ============================================================================ // Outputs // ============================================================================ -@description('Resource ID of the Cosmos DB account.') +@description('Resource ID of the Azure Cosmos DB account.') output resourceId string = cosmos.id -@description('Name of the Cosmos DB account.') +@description('Name of the Azure Cosmos DB account.') output name string = cosmos.name -@description('Endpoint of the Cosmos DB account.') +@description('Endpoint of the Azure Cosmos DB account.') output endpoint string = 'https://${name}.documents.azure.com:443/' @description('Database name.') diff --git a/infra/bicep/modules/data/postgresql-flexible-server.bicep b/infra/bicep/modules/data/postgresql-flexible-server.bicep index 52b6a77c..45be45fc 100644 --- a/infra/bicep/modules/data/postgresql-flexible-server.bicep +++ b/infra/bicep/modules/data/postgresql-flexible-server.bicep @@ -10,7 +10,7 @@ param location string @description('Tags to apply to the resource.') param tags object = {} -@description('Azure AD administrators for the server. Each entry requires objectId, principalName, and principalType (User, Group, or ServicePrincipal).') +@description('Microsoft Entra ID administrators for the server. Each entry requires objectId, principalName, and principalType (User, Group, or ServicePrincipal).') param administrators array @description('The PostgreSQL version to deploy.') diff --git a/infra/bicep/modules/identity/role-assignments.bicep b/infra/bicep/modules/identity/role-assignments.bicep index 7156fb29..c61134bd 100644 --- a/infra/bicep/modules/identity/role-assignments.bicep +++ b/infra/bicep/modules/identity/role-assignments.bicep @@ -22,7 +22,7 @@ param existingFoundryProjectResourceId string = '' @description('Principal ID of the AI project identity (works for both new and existing projects).') param aiProjectPrincipalId string = '' -@description('Principal ID of the AI Search identity.') +@description('Principal ID of the Azure AI Search identity.') param aiSearchPrincipalId string = '' @description('Principal IDs of the all App Service system-assigned identities (empty if not deployed).') @@ -37,13 +37,13 @@ param deployerPrincipalType string = 'User' // --- Resource References --- -@description('Resource ID of the AI Foundry account (empty if not deployed β€” new project path).') +@description('Resource ID of the Azure AI Foundry account (empty if not deployed β€” new project path).') param aiFoundryResourceId string = '' -@description('Resource ID of the AI Search service (empty if not deployed).') +@description('Resource ID of the Azure AI Search service (empty if not deployed).') param aiSearchResourceId string = '' -@description('Name of the Cosmos DB account (empty if not deployed).') +@description('Name of the Azure Cosmos DB account (empty if not deployed).') param cosmosDbAccountName string = '' @description('Resource ID of the container registry (empty if not deployed).') @@ -90,7 +90,7 @@ resource cosmosAccount 'Microsoft.DocumentDB/databaseAccounts@2025-10-15' existi resource cosmosContributorRoleDefinition 'Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions@2025-10-15' existing = if (!empty(cosmosDbAccountName)) { parent: cosmosAccount - name: '00000000-0000-0000-0000-000000000002' // Cosmos DB Built-in Data Contributor + name: '00000000-0000-0000-0000-000000000002' // Azure Cosmos DB Built-in Data Contributor } resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' existing = if (!empty(containerRegistryResourceId)) { @@ -99,10 +99,10 @@ resource containerRegistry 'Microsoft.ContainerRegistry/registries@2025-04-01' e // ============================================================================ // 1. AI SERVICES ROLE ASSIGNMENTS -// Cross-service roles scoped to AI Foundry account +// Cross-service roles scoped to Azure AI Foundry account // ============================================================================ -// AI Search β†’ Cognitive Services OpenAI User on AI Foundry (new project, same RG) +// Azure AI Search β†’ Cognitive Services Azure OpenAI User on Azure AI Foundry (new project, same RG) resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiSearchPrincipalId) && !empty(aiFoundryResourceId)) { name: guid(solutionName, aiFoundryAccount.id, aiSearchPrincipalId, roleDefinitions.cognitiveServicesOpenAIUser) scope: aiFoundryAccount @@ -113,7 +113,7 @@ resource assignOpenAIRoleToAISearch 'Microsoft.Authorization/roleAssignments@202 } } -// AI Search β†’ Cognitive Services OpenAI User on existing AI Foundry (cross-scope) +// Azure AI Search β†’ Cognitive Services Azure OpenAI User on existing Azure AI Foundry (cross-scope) module assignOpenAIToSearchExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(aiSearchPrincipalId)) { name: 'assignOpenAIRoleToAISearchExisting' scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup) @@ -125,7 +125,7 @@ module assignOpenAIToSearchExisting './cross-scope-role-assignment.bicep' = if ( } } -// Chat Backend App Service β†’ Cognitive Services User on AI Foundry (new project β€” required for Voice Live and agents) +// Chat Backend App Service β†’ Cognitive Services User on Azure AI Foundry (new project β€” required for Voice Live and agents) resource backendAppCogServicesUserAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!useExistingAIProject && !empty(aiFoundryResourceId) && !empty(appServicePrincipalIds.chatBackendApp)) { name: guid(solutionName, aiFoundryAccount.id, appServicePrincipalIds.chatBackendApp, roleDefinitions.cognitiveServicesUser) scope: aiFoundryAccount @@ -136,7 +136,7 @@ resource backendAppCogServicesUserAssignment 'Microsoft.Authorization/roleAssign } } -// Chat Backend App Service β†’ Cognitive Services User on existing AI Foundry (cross-scope β€” Voice Live and agents) +// Chat Backend App Service β†’ Cognitive Services User on existing Azure AI Foundry (cross-scope β€” Voice Live and agents) module backendAppCogServicesUserExisting './cross-scope-role-assignment.bicep' = if (useExistingAIProject && !empty(appServicePrincipalIds.chatBackendApp)) { name: 'assignCogServicesUserRoleToBackendExisting' scope: resourceGroup(existingAIFoundrySubscription, existingAIFoundryResourceGroup) @@ -150,10 +150,10 @@ module backendAppCogServicesUserExisting './cross-scope-role-assignment.bicep' = // ============================================================================ // 2. SEARCH SERVICE ROLE ASSIGNMENTS -// AI Project and Backend identities β†’ AI Search +// AI Project and Backend identities β†’ Azure AI Search // ============================================================================ -// AI Project β†’ Search Index Data Reader on AI Search +// AI Project β†’ Search Index Data Reader on Azure AI Search resource projectSearchReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) { name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchIndexDataReader) scope: aiSearchService @@ -164,7 +164,7 @@ resource projectSearchReader 'Microsoft.Authorization/roleAssignments@2022-04-01 } } -// AI Project β†’ Search Service Contributor on AI Search +// AI Project β†’ Search Service Contributor on Azure AI Search resource projectSearchContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(aiProjectPrincipalId)) { name: guid(solutionName, aiSearchService.id, aiProjectPrincipalId, roleDefinitions.searchServiceContributor) scope: aiSearchService @@ -175,7 +175,7 @@ resource projectSearchContributor 'Microsoft.Authorization/roleAssignments@2022- } } -// Chat Backend App Service β†’ Search Index Data Contributor on AI Search +// Chat Backend App Service β†’ Search Index Data Contributor on Azure AI Search resource chatBackendAppSearchContributorAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(aiSearchResourceId) && !empty(appServicePrincipalIds.chatBackendApp)) { name: guid(solutionName, aiSearchService.id, appServicePrincipalIds.chatBackendApp, roleDefinitions.searchIndexDataContributor) scope: aiSearchService @@ -187,8 +187,8 @@ resource chatBackendAppSearchContributorAssignment 'Microsoft.Authorization/role } // ============================================================================ -// 3. COSMOS DB ROLE ASSIGNMENTS -// Backend App Service β†’ Cosmos DB (data-plane, uses sqlRoleAssignments) +// 3. Azure Cosmos DB ROLE ASSIGNMENTS +// Backend App Service β†’ Azure Cosmos DB (data-plane, uses sqlRoleAssignments) // ============================================================================ resource chatBackendAppCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2025-10-15' = if (!empty(cosmosDbAccountName) && !empty(appServicePrincipalIds.chatBackendApp)) { @@ -213,7 +213,7 @@ resource scenarioBackendAppCosmosRoleAssignment 'Microsoft.DocumentDB/databaseAc // ============================================================================ // 4. DEPLOYER (USER) ROLE ASSIGNMENTS -// Deploying user β†’ AI Services, Search, Cosmos DB (Bicep-only) +// Deploying user β†’ AI Services, Search, Azure Cosmos DB (Bicep-only) // ============================================================================ // Deploying User β†’ Foundry User on AI Services @@ -238,7 +238,7 @@ resource deployerAzureAIDeveloper 'Microsoft.Authorization/roleAssignments@2022- } } -// Deploying User β†’ Search Service Contributor on AI Search +// Deploying User β†’ Search Service Contributor on Azure AI Search resource deployerSearchServiceContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(aiSearchResourceId)) { scope: aiSearchService name: guid(solutionName, aiSearchService.id, deployerPrincipalId, roleDefinitions.searchServiceContributor) @@ -249,7 +249,7 @@ resource deployerSearchServiceContributor 'Microsoft.Authorization/roleAssignmen } } -// Deploying User β†’ Search Index Data Contributor on AI Search +// Deploying User β†’ Search Index Data Contributor on Azure AI Search resource deployerSearchIndexContributor 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(aiSearchResourceId)) { scope: aiSearchService name: guid(solutionName, aiSearchService.id, deployerPrincipalId, roleDefinitions.searchIndexDataContributor) @@ -260,7 +260,7 @@ resource deployerSearchIndexContributor 'Microsoft.Authorization/roleAssignments } } -// Deploying User β†’ Search Index Data Reader on AI Search +// Deploying User β†’ Search Index Data Reader on Azure AI Search resource deployerSearchIndexReader 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (!empty(deployerPrincipalId) && !empty(aiSearchResourceId)) { scope: aiSearchService name: guid(solutionName, aiSearchService.id, deployerPrincipalId, roleDefinitions.searchIndexDataReader) @@ -271,7 +271,7 @@ resource deployerSearchIndexReader 'Microsoft.Authorization/roleAssignments@2022 } } -// Deploying User β†’ Cosmos DB Data Contributor +// Deploying User β†’ Azure Cosmos DB Data Contributor resource deployerCosmosDbContributor 'Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments@2025-10-15' = if (!empty(cosmosDbAccountName) && !empty(deployerPrincipalId)) { parent: cosmosAccount name: guid(solutionName, cosmosContributorRoleDefinition.id, cosmosAccount.id, deployerPrincipalId) diff --git a/infra/main.bicep b/infra/main.bicep index cb2d77b1..e4adbd1b 100644 --- a/infra/main.bicep +++ b/infra/main.bicep @@ -46,7 +46,7 @@ param solutionUniqueText string = substring(uniqueString(subscription().id, reso param location string @description('Optional. Tags to apply to all resources.') -param tags object = {} +param tags object = { } @allowed([ 'eastus2' @@ -65,7 +65,7 @@ param tags object = {} ] } }) -@description('Required. Location for AI Foundry and model deployments.') +@description('Required. Location for Azure AI Foundry and model deployments.') param azureAiServiceLocation string @description('Deployment scenario: ecommerce, healthcare, or banking') @@ -120,7 +120,7 @@ param gptRealtimeModelVersion string = '2025-12-15' @description('Optional. Capacity of the realtime model deployment.') param gptRealtimeDeploymentCapacity int = 1 -@description('Optional. Azure OpenAI API version.') +@description('Optional. OpenAI API version.') param azureOpenaiAPIVersion string = '2025-01-01-preview' @description('Optional. Azure AI Agent API version.') @@ -141,7 +141,7 @@ param appServicePlanSku string = 'B2' @description('Optional. Resource ID of an existing Log Analytics workspace. Empty creates a new one when monitoring is enabled.') param existingLogAnalyticsWorkspaceId string = '' -@description('Optional. Resource ID of an existing AI Foundry project. Empty creates a new one.') +@description('Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one.') param existingFoundryProjectResourceId string = '' // ============================================================================ @@ -172,10 +172,10 @@ param enablePrivateNetworking bool = false @description('Optional. Enable scalability features (zone redundant App Service Plan).') param enableScalability bool = false -@description('Optional. Enable redundancy (zone redundant Cosmos DB, multi-region failover).') +@description('Optional. Enable redundancy (zone redundant Azure Cosmos DB, multi-region failover).') param enableRedundancy bool = false -@description('Optional. Secondary CosmosDB location for high availability.') +@description('Optional. Secondary Azure Cosmos DB location for high availability.') param secondaryLocation string = 'canadacentral' @secure() diff --git a/infra/main.json b/infra/main.json index c0988116..7a14feb3 100644 --- a/infra/main.json +++ b/infra/main.json @@ -5,8 +5,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "1130790663632080876" + "version": "0.45.15.27210", + "templateHash": "6717713924327194381" } }, "parameters": { @@ -82,7 +82,7 @@ "OpenAI.GlobalStandard.gpt-realtime-mini,1" ] }, - "description": "Required. Location for AI Foundry and model deployments." + "description": "Required. Location for Azure AI Foundry and model deployments." } }, "deploymentScenario": { @@ -177,7 +177,7 @@ "type": "string", "defaultValue": "2025-01-01-preview", "metadata": { - "description": "Optional. Azure OpenAI API version." + "description": "Optional. OpenAI API version." } }, "azureAiAgentApiVersion": { @@ -220,7 +220,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one." + "description": "Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one." } }, "deployingUserPrincipalType": { @@ -266,14 +266,14 @@ "type": "bool", "defaultValue": false, "metadata": { - "description": "Optional. Enable redundancy (zone redundant Cosmos DB, multi-region failover)." + "description": "Optional. Enable redundancy (zone redundant Azure Cosmos DB, multi-region failover)." } }, "secondaryLocation": { "type": "string", "defaultValue": "canadacentral", "metadata": { - "description": "Optional. Secondary CosmosDB location for high availability." + "description": "Optional. Secondary Azure Cosmos DB location for high availability." } }, "vmAdminUsername": { @@ -387,8 +387,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "18235037256776572197" + "version": "0.45.15.27210", + "templateHash": "15491613390743974800" } }, "parameters": { @@ -453,7 +453,7 @@ "OpenAI.GlobalStandard.gpt-realtime-mini,1" ] }, - "description": "Required. Location for AI Foundry and model deployments." + "description": "Required. Location for Azure AI Foundry and model deployments." } }, "deploymentScenario": { @@ -548,7 +548,7 @@ "type": "string", "defaultValue": "2025-01-01-preview", "metadata": { - "description": "Optional. Azure OpenAI API version." + "description": "Optional. OpenAI API version." } }, "azureAiAgentApiVersion": { @@ -598,7 +598,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one." + "description": "Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one." } }, "deployingUserPrincipalType": { @@ -707,8 +707,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "12829235775567600920" + "version": "0.45.15.27210", + "templateHash": "1562511690153284384" } }, "parameters": { @@ -837,8 +837,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "17497827752064117634" + "version": "0.45.15.27210", + "templateHash": "1396979465821863055" } }, "parameters": { @@ -997,8 +997,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "8511660641005875858" + "version": "0.45.15.27210", + "templateHash": "14710745103930099805" } }, "parameters": { @@ -1019,7 +1019,7 @@ "type": "string", "defaultValue": "[format('proj-{0}', parameters('solutionName'))]", "metadata": { - "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}." + "description": "Optional. Override name for the Azure AI Foundry project. Defaults to proj-{solutionName}." } }, "location": { @@ -1053,7 +1053,7 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "Optional. Whether to allow project management (AI Foundry hub)." + "description": "Optional. Whether to allow project management (Azure AI Foundry hub)." } }, "publicNetworkAccess": { @@ -1153,7 +1153,7 @@ "azureOpenAiCuEndpoint": { "type": "string", "metadata": { - "description": "Azure OpenAI Content Understanding endpoint URL." + "description": "OpenAI Content Understanding endpoint URL." }, "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]" }, @@ -1167,14 +1167,14 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, @@ -1222,8 +1222,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "6434598355203707033" + "version": "0.45.15.27210", + "templateHash": "17323730446378630757" } }, "parameters": { @@ -1273,7 +1273,7 @@ "azureOpenAiCuEndpoint": { "type": "string", "metadata": { - "description": "Azure OpenAI Content Understanding endpoint URL." + "description": "OpenAI Content Understanding endpoint URL." }, "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '2025-12-01').endpoints['Content Understanding']]" }, @@ -1287,14 +1287,14 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, @@ -1360,8 +1360,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "6715448001846817199" + "version": "0.45.15.27210", + "templateHash": "3303748358923315881" } }, "parameters": { @@ -1498,8 +1498,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "778242983230747658" + "version": "0.45.15.27210", + "templateHash": "9950595487577758814" } }, "parameters": { @@ -1687,15 +1687,15 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "16237442077230849366" + "version": "0.45.15.27210", + "templateHash": "7691531029197971157" } }, "parameters": { "name": { "type": "string", "metadata": { - "description": "The name of the existing AI Search service." + "description": "The name of the existing Azure AI Search service." } }, "location": { @@ -1815,7 +1815,7 @@ "systemAssignedMIPrincipalId": { "type": "string", "metadata": { - "description": "The principal ID of the AI Search system-assigned managed identity." + "description": "The principal ID of the Azure AI Search system-assigned managed identity." }, "value": "[reference(resourceId('Microsoft.Search/searchServices', parameters('name')), '2025-05-01', 'full').identity.principalId]" } @@ -1831,21 +1831,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Search service." + "description": "Resource ID of the Azure AI Search service." }, "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]" }, "name": { "type": "string", "metadata": { - "description": "Name of the AI Search service." + "description": "Name of the Azure AI Search service." }, "value": "[parameters('name')]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint URL of the AI Search service." + "description": "Endpoint URL of the Azure AI Search service." }, "value": "[format('https://{0}.search.windows.net', parameters('name'))]" }, @@ -1902,8 +1902,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "8750708162978576025" + "version": "0.45.15.27210", + "templateHash": "5046364178840388691" } }, "parameters": { @@ -1916,7 +1916,7 @@ "projectName": { "type": "string", "metadata": { - "description": "Required. Name of the AI Foundry project." + "description": "Required. Name of the Azure AI Foundry project." } }, "solutionName": { @@ -2080,12 +2080,13 @@ }, "template": { "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#", + "languageVersion": "2.0", "contentVersion": "1.0.0.0", "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "16072023559576139398" + "version": "0.45.15.27210", + "templateHash": "4107269099544654905" } }, "parameters": { @@ -2099,7 +2100,7 @@ "type": "string", "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." } }, "location": { @@ -2124,6 +2125,17 @@ }, "containers": { "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "partitionKeyPath": { + "type": "string" + } + } + }, "defaultValue": [ { "name": "conversations", @@ -2144,8 +2156,8 @@ } } }, - "resources": [ - { + "resources": { + "database::list": { "copy": { "name": "database::list", "count": "[length(parameters('containers'))]" @@ -2165,10 +2177,10 @@ "options": {} }, "dependsOn": [ - "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('name'), parameters('databaseName'))]" + "database" ] }, - { + "cosmos": { "type": "Microsoft.DocumentDB/databaseAccounts", "apiVersion": "2025-10-15", "name": "[parameters('name')]", @@ -2198,7 +2210,7 @@ ] } }, - { + "database": { "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases", "apiVersion": "2025-10-15", "name": "[format('{0}/{1}', parameters('name'), parameters('databaseName'))]", @@ -2208,29 +2220,29 @@ } }, "dependsOn": [ - "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" + "cosmos" ] } - ], + }, "outputs": { "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the Cosmos DB account." + "description": "Resource ID of the Azure Cosmos DB account." }, "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]" }, "name": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[parameters('name')]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint of the Cosmos DB account." + "description": "Endpoint of the Azure Cosmos DB account." }, "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]" }, @@ -2287,8 +2299,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "7309270875979052806" + "version": "0.45.15.27210", + "templateHash": "634033543361922430" } }, "parameters": { @@ -2457,8 +2469,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "14921737129205933042" + "version": "0.45.15.27210", + "templateHash": "4537280756464844268" } }, "parameters": { @@ -2691,8 +2703,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "12196797251843480266" + "version": "0.45.15.27210", + "templateHash": "4923875466157929514" } }, "parameters": { @@ -2999,8 +3011,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "12196797251843480266" + "version": "0.45.15.27210", + "templateHash": "4923875466157929514" } }, "parameters": { @@ -3347,8 +3359,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "12196797251843480266" + "version": "0.45.15.27210", + "templateHash": "4923875466157929514" } }, "parameters": { @@ -3656,8 +3668,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "12196797251843480266" + "version": "0.45.15.27210", + "templateHash": "4923875466157929514" } }, "parameters": { @@ -3966,8 +3978,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "17289391055173016668" + "version": "0.45.15.27210", + "templateHash": "4601633220910924569" } }, "parameters": { @@ -4003,7 +4015,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Principal ID of the AI Search identity." + "description": "Principal ID of the Azure AI Search identity." } }, "appServicePrincipalIds": { @@ -4035,21 +4047,21 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Foundry account (empty if not deployed β€” new project path)." + "description": "Resource ID of the Azure AI Foundry account (empty if not deployed β€” new project path)." } }, "aiSearchResourceId": { "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Search service (empty if not deployed)." + "description": "Resource ID of the Azure AI Search service (empty if not deployed)." } }, "cosmosDbAccountName": { "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the Cosmos DB account (empty if not deployed)." + "description": "Name of the Azure Cosmos DB account (empty if not deployed)." } }, "containerRegistryResourceId": { @@ -4309,8 +4321,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "1989127288943974415" + "version": "0.45.15.27210", + "templateHash": "1300049152829937087" } }, "parameters": { @@ -4431,8 +4443,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "1989127288943974415" + "version": "0.45.15.27210", + "templateHash": "1300049152829937087" } }, "parameters": { @@ -4590,35 +4602,35 @@ "AZURE_COSMOSDB_ACCOUNT": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.name.value]" }, "COSMOS_DB_ENDPOINT": { "type": "string", "metadata": { - "description": "Cosmos DB endpoint URL." + "description": "Azure Cosmos DB endpoint URL." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.endpoint.value]" }, "COSMOS_DB_DATABASE_NAME": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database." + "description": "Name of the Azure Cosmos DB database." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]" }, "AZURE_COSMOSDB_CONVERSATIONS_CONTAINER": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB container for chat conversations." + "description": "Name of the Azure Cosmos DB container for chat conversations." }, "value": "chat_sessions" }, "AZURE_COSMOSDB_DATABASE": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database (alias)." + "description": "Name of the Azure Cosmos DB database (alias)." }, "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, resourceGroup().name), 'Microsoft.Resources/deployments', take(format('module.cosmos-db-nosql.{0}', parameters('solutionName')), 64)), '2025-04-01').outputs.databaseName.value]" }, @@ -4995,8 +5007,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "4526071171632831008" + "version": "0.45.15.27210", + "templateHash": "15825270133024493599" } }, "parameters": { @@ -5061,7 +5073,7 @@ "OpenAI.GlobalStandard.gpt-realtime-mini,1" ] }, - "description": "Required. Location for AI Foundry and model deployments." + "description": "Required. Location for Azure AI Foundry and model deployments." } }, "deploymentScenario": { @@ -5227,7 +5239,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Optional. Resource ID of an existing AI Foundry project. Empty creates a new one." + "description": "Optional. Resource ID of an existing Azure AI Foundry project. Empty creates a new one." } }, "deployingUserPrincipalType": { @@ -5245,7 +5257,7 @@ "type": "string", "defaultValue": "canadacentral", "metadata": { - "description": "Optional. Secondary CosmosDB location for high availability." + "description": "Optional. Secondary Azure Cosmos DB location for high availability." } }, "vmAdminUsername": { @@ -5435,8 +5447,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "13057004032172561022" + "version": "0.45.15.27210", + "templateHash": "8088039885965286237" } }, "parameters": { @@ -8737,8 +8749,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "15211167376897453419" + "version": "0.45.15.27210", + "templateHash": "17593462233384180904" } }, "parameters": { @@ -9664,8 +9676,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "6476447410274580151" + "version": "0.45.15.27210", + "templateHash": "11868321282699299231" } }, "definitions": { @@ -12530,8 +12542,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "9116500550183450565" + "version": "0.45.15.27210", + "templateHash": "5843178535659210113" } }, "parameters": { @@ -14434,8 +14446,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "5272027087445572747" + "version": "0.45.15.27210", + "templateHash": "1089854782656841223" } }, "parameters": { @@ -14974,8 +14986,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "11479330755037849383" + "version": "0.45.15.27210", + "templateHash": "8930408375182742451" } }, "parameters": { @@ -16443,8 +16455,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "6662408081790292224" + "version": "0.45.15.27210", + "templateHash": "9515837065104451474" } }, "parameters": { @@ -16952,8 +16964,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "9028893310045880819" + "version": "0.45.15.27210", + "templateHash": "18103466400870370455" } }, "parameters": { @@ -26308,8 +26320,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "6269193753809634195" + "version": "0.45.15.27210", + "templateHash": "6776150673571028467" } }, "parameters": { @@ -29816,8 +29828,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "8028799539155931791" + "version": "0.45.15.27210", + "templateHash": "6476709335461897153" } }, "parameters": { @@ -29838,7 +29850,7 @@ "type": "string", "defaultValue": "[format('proj-{0}', parameters('solutionName'))]", "metadata": { - "description": "Optional. Override name for the AI Foundry project. Defaults to proj-{solutionName}." + "description": "Optional. Override name for the Azure AI Foundry project. Defaults to proj-{solutionName}." } }, "location": { @@ -29872,7 +29884,7 @@ "type": "bool", "defaultValue": true, "metadata": { - "description": "Optional. Whether to allow project management (AI Foundry hub)." + "description": "Optional. Whether to allow project management (Azure AI Foundry hub)." } }, "publicNetworkAccess": { @@ -32519,21 +32531,21 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, "projectEndpoint": { "type": "string", "metadata": { - "description": "AI Foundry project endpoint." + "description": "Azure AI Foundry project endpoint." }, "value": "[reference('aiProject').endpoints['AI Foundry API']]" }, @@ -32616,8 +32628,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "2563730588707091687" + "version": "0.45.15.27210", + "templateHash": "13058032099310447838" } }, "parameters": { @@ -33364,8 +33376,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "705358977237504297" + "version": "0.45.15.27210", + "templateHash": "4547396846815855075" } }, "parameters": { @@ -33429,21 +33441,21 @@ "projectResourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Foundry project." + "description": "Resource ID of the Azure AI Foundry project." }, "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName'))]" }, "projectName": { "type": "string", "metadata": { - "description": "Name of the AI Foundry project." + "description": "Name of the Azure AI Foundry project." }, "value": "[parameters('projectName')]" }, "projectEndpoint": { "type": "string", "metadata": { - "description": "AI Foundry project endpoint." + "description": "Azure AI Foundry project endpoint." }, "value": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('name'), parameters('projectName')), '2025-12-01').endpoints['AI Foundry API']]" }, @@ -33502,8 +33514,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "6715448001846817199" + "version": "0.45.15.27210", + "templateHash": "3303748358923315881" } }, "parameters": { @@ -33670,8 +33682,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "3261808213176490944" + "version": "0.45.15.27210", + "templateHash": "12097105566229065476" } }, "definitions": { @@ -34178,7 +34190,7 @@ "type": "array", "defaultValue": [], "metadata": { - "description": "Optional. Array of role assignments to create on the AI Search service." + "description": "Optional. Array of role assignments to create on the Azure AI Search service." } } }, @@ -36287,21 +36299,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the AI Search service." + "description": "Resource ID of the Azure AI Search service." }, "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]" }, "name": { "type": "string", "metadata": { - "description": "Name of the AI Search service." + "description": "Name of the Azure AI Search service." }, "value": "[parameters('name')]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint URL of the AI Search service." + "description": "Endpoint URL of the Azure AI Search service." }, "value": "[format('https://{0}.search.windows.net', parameters('name'))]" }, @@ -36359,8 +36371,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "8750708162978576025" + "version": "0.45.15.27210", + "templateHash": "5046364178840388691" } }, "parameters": { @@ -36373,7 +36385,7 @@ "projectName": { "type": "string", "metadata": { - "description": "Required. Name of the AI Foundry project." + "description": "Required. Name of the Azure AI Foundry project." } }, "solutionName": { @@ -36554,8 +36566,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "5504060809490275188" + "version": "0.45.15.27210", + "templateHash": "14855699799284856128" } }, "definitions": { @@ -36927,7 +36939,7 @@ "type": "string", "defaultValue": "[format('cosmos-{0}', parameters('solutionName'))]", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." } }, "location": { @@ -36952,6 +36964,17 @@ }, "containers": { "type": "array", + "items": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "partitionKeyPath": { + "type": "string" + } + } + }, "defaultValue": [ { "name": "conversations", @@ -36988,7 +37011,7 @@ "items": { "$ref": "#/definitions/privateEndpointSingleServiceType" }, - "nullable": true, + "defaultValue": [], "metadata": { "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible." } @@ -43008,21 +43031,21 @@ "resourceId": { "type": "string", "metadata": { - "description": "Resource ID of the Cosmos DB account." + "description": "Resource ID of the Azure Cosmos DB account." }, "value": "[reference('cosmosAccount').outputs.resourceId.value]" }, "name": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[reference('cosmosAccount').outputs.name.value]" }, "endpoint": { "type": "string", "metadata": { - "description": "Endpoint of the Cosmos DB account." + "description": "Endpoint of the Azure Cosmos DB account." }, "value": "[format('https://{0}.documents.azure.com:443/', parameters('name'))]" }, @@ -43094,8 +43117,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "5809745100524015651" + "version": "0.45.15.27210", + "templateHash": "11545178839017345310" } }, "definitions": { @@ -43587,7 +43610,7 @@ "type": "string", "defaultValue": "enabled", "metadata": { - "description": "Azure AD authentication as ARM policy status." + "description": "Microsoft Entra ID authentication as ARM policy status." } } }, @@ -47544,8 +47567,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "7722311537111875045" + "version": "0.45.15.27210", + "templateHash": "17112276975229652402" } }, "parameters": { @@ -48521,8 +48544,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "17881259901050695278" + "version": "0.45.15.27210", + "templateHash": "9004187060827479743" } }, "definitions": { @@ -64087,8 +64110,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "17881259901050695278" + "version": "0.45.15.27210", + "templateHash": "9004187060827479743" } }, "definitions": { @@ -79695,8 +79718,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "17881259901050695278" + "version": "0.45.15.27210", + "templateHash": "9004187060827479743" } }, "definitions": { @@ -95264,8 +95287,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "17881259901050695278" + "version": "0.45.15.27210", + "templateHash": "9004187060827479743" } }, "definitions": { @@ -110807,8 +110830,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "16279263826646088113" + "version": "0.45.15.27210", + "templateHash": "10434475903975084916" } }, "parameters": { @@ -110844,7 +110867,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Principal ID of the AI Search identity." + "description": "Principal ID of the Azure AI Search identity." } }, "appServicePrincipalIds": { @@ -110858,28 +110881,28 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Principal ID of the deploying user (for deployer Cosmos DB access)." + "description": "Principal ID of the deploying user (for deployer Azure Cosmos DB access)." } }, "aiFoundryResourceId": { "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Foundry account (empty if not deployed β€” new project path)." + "description": "Resource ID of the Azure AI Foundry account (empty if not deployed β€” new project path)." } }, "aiSearchResourceId": { "type": "string", "defaultValue": "", "metadata": { - "description": "Resource ID of the AI Search service (empty if not deployed)." + "description": "Resource ID of the Azure AI Search service (empty if not deployed)." } }, "cosmosDbAccountName": { "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the Cosmos DB account (empty if not deployed)." + "description": "Name of the Azure Cosmos DB account (empty if not deployed)." } } }, @@ -111023,8 +111046,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "8340198449457510026" + "version": "0.45.15.27210", + "templateHash": "13897284585221236671" } }, "parameters": { @@ -111073,7 +111096,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." + "description": "Name of the target Azure AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." } }, "containerRegistryName": { @@ -111145,8 +111168,8 @@ "metadata": { "_generator": { "name": "bicep", - "version": "0.45.6.27763", - "templateHash": "8340198449457510026" + "version": "0.45.15.27210", + "templateHash": "13897284585221236671" } }, "parameters": { @@ -111195,7 +111218,7 @@ "type": "string", "defaultValue": "", "metadata": { - "description": "Name of the target AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." + "description": "Name of the target Azure AI Foundry (Cognitive Services) account. Required when targetResourceType is AIServices." } }, "containerRegistryName": { @@ -111301,70 +111324,70 @@ "AZURE_COSMOSDB_ACCOUNT": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB account." + "description": "Name of the Azure Cosmos DB account." }, "value": "[reference('cosmosDBModule').outputs.name.value]" }, "COSMOS_DB_ENDPOINT": { "type": "string", "metadata": { - "description": "Cosmos DB endpoint URL." + "description": "Azure Cosmos DB endpoint URL." }, "value": "[reference('cosmosDBModule').outputs.endpoint.value]" }, "COSMOS_DB_DATABASE_NAME": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database." + "description": "Name of the Azure Cosmos DB database." }, "value": "[reference('cosmosDBModule').outputs.databaseName.value]" }, "AZURE_COSMOSDB_CONVERSATIONS_CONTAINER": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB container for chat conversations." + "description": "Name of the Azure Cosmos DB container for chat conversations." }, "value": "chat_sessions" }, "AZURE_COSMOSDB_DATABASE": { "type": "string", "metadata": { - "description": "Name of the Cosmos DB database (alias)." + "description": "Name of the Azure Cosmos DB database (alias)." }, "value": "[reference('cosmosDBModule').outputs.databaseName.value]" }, "AZURE_OPENAI_DEPLOYMENT_MODEL": { "type": "string", "metadata": { - "description": "Azure OpenAI GPT model deployment name." + "description": "OpenAI GPT model deployment name." }, "value": "[parameters('gptModelName')]" }, "AZURE_OPENAI_EMBEDDING_MODEL": { "type": "string", "metadata": { - "description": "Azure OpenAI embedding model name." + "description": "OpenAI embedding model name." }, "value": "[parameters('embeddingModel')]" }, "AZURE_OPENAI_EMBEDDING_MODEL_CAPACITY": { "type": "int", "metadata": { - "description": "Azure OpenAI embedding model deployment capacity." + "description": "OpenAI embedding model deployment capacity." }, "value": "[parameters('embeddingDeploymentCapacity')]" }, "AZURE_OPENAI_ENDPOINT": { "type": "string", "metadata": { - "description": "Azure OpenAI service endpoint URL." + "description": "OpenAI service endpoint URL." }, "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.endpoint.value, reference('ai_foundry_project').outputs.endpoint.value)]" }, "AZURE_OPENAI_MODEL_DEPLOYMENT_TYPE": { "type": "string", "metadata": { - "description": "Azure OpenAI model deployment type." + "description": "OpenAI model deployment type." }, "value": "[parameters('deploymentType')]" }, @@ -111378,14 +111401,14 @@ "AZURE_OPENAI_API_VERSION": { "type": "string", "metadata": { - "description": "API version for Azure OpenAI service." + "description": "API version for OpenAI service." }, "value": "[parameters('azureOpenaiAPIVersion')]" }, "AZURE_OPENAI_RESOURCE": { "type": "string", "metadata": { - "description": "Name of the Azure OpenAI resource." + "description": "Name of the OpenAI resource." }, "value": "[if(variables('useExistingAIProject'), reference('existing_project_setup').outputs.name.value, reference('ai_foundry_project').outputs.name.value)]" }, diff --git a/infra/scripts/post-provision/agent_scripts/01_create_agents.py b/infra/scripts/post-provision/agent_scripts/01_create_agents.py index 6fae862f..70920e69 100644 --- a/infra/scripts/post-provision/agent_scripts/01_create_agents.py +++ b/infra/scripts/post-provision/agent_scripts/01_create_agents.py @@ -50,7 +50,7 @@ async def get_ai_search_connection_id(project_client: AIProjectClient) -> str: if connection.target == ai_search_endpoint: return connection.id raise Exception( - f"Could not find AI Search connection for {ai_search_endpoint}." + f"Could not find Azure AI Search connection for {ai_search_endpoint}." ) diff --git a/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.ps1 b/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.ps1 index 5d2c0b0c..39404610 100644 --- a/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.ps1 +++ b/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.ps1 @@ -268,7 +268,7 @@ Write-Host "Resource Group: $resourceGroup" Write-Host "Project Endpoint: $projectEndpoint" Write-Host "Solution Name: $solutionName" Write-Host "GPT Model Name: $gptModelName" -Write-Host "AI Foundry Resource ID: $aiFoundryResourceId" +Write-Host "Azure AI Foundry Resource ID: $aiFoundryResourceId" Write-Host "API App Name: $apiAppName" Write-Host "Search Endpoint: $searchEndpoint" Write-Host "Subscription ID: $azSubscriptionId" @@ -293,7 +293,7 @@ if (-not $aifSubscriptionId) { Write-Host "Getting signed in user id" $signed_user_id = az ad signed-in-user show --query id -o tsv -Write-Host "Checking if the user has Foundry User role on the AI Foundry" +Write-Host "Checking if the user has Foundry User role on the Azure AI Foundry" $role_assignment = az role assignment list ` --role "53ca6127-db72-4b80-b1b0-d745d6d5456d" ` --scope "$aiFoundryResourceId" ` @@ -329,9 +329,9 @@ Write-Host "Installing Python requirements..." python -m pip install --upgrade pip python -m pip install --quiet -r "$requirementFile" -# For WAF deployments, temporarily enable public network access on AI Foundry +# For WAF deployments, temporarily enable public network access on Azure AI Foundry # (account id/name/rg/subscription already extracted above). -Write-Host "Checking AI Foundry network settings..." +Write-Host "Checking Azure AI Foundry network settings..." # Get current public network access setting $originalFoundryPublicAccess = az cognitiveservices account show --name $aifResourceName --resource-group $aifResourceGroup --subscription $aifSubscriptionId --query "properties.publicNetworkAccess" -o tsv 2>$null @@ -339,11 +339,11 @@ $foundryAccessEnabled = $false # Check if public network access is disabled (WAF deployment) if ($originalFoundryPublicAccess -eq "Disabled") { - Write-Host "AI Foundry public network access is disabled. Temporarily enabling for agent creation..." + Write-Host "Azure AI Foundry public network access is disabled. Temporarily enabling for agent creation..." az resource update --ids $aifAccountResourceId --api-version 2024-10-01 --set "properties.publicNetworkAccess=Enabled" "properties.apiProperties={}" --output none 2>$null if ($LASTEXITCODE -eq 0) { - Write-Host "Successfully enabled public network access on AI Foundry." + Write-Host "Successfully enabled public network access on Azure AI Foundry." $foundryAccessEnabled = $true } else { Write-Host "Warning: Could not enable public network access. You may need to enable it manually in Azure Portal." @@ -353,7 +353,7 @@ if ($originalFoundryPublicAccess -eq "Disabled") { Write-Host "Waiting for network settings to propagate (60 seconds)..." Start-Sleep -Seconds 60 } else { - Write-Host "AI Foundry public network access is already enabled." + Write-Host "Azure AI Foundry public network access is already enabled." } # Execute the Python scripts within try/finally to ensure network settings are restored on error @@ -410,10 +410,10 @@ finally { # Restore original settings - disable public network access if we enabled it # This block ALWAYS runs, even if an error occurred if ($foundryAccessEnabled) { - Write-Host "Restoring original AI Foundry settings (disabling public network access)..." + Write-Host "Restoring original Azure AI Foundry settings (disabling public network access)..." az resource update --ids $aifAccountResourceId --api-version 2024-10-01 --set "properties.publicNetworkAccess=Disabled" "properties.apiProperties.qnaAzureSearchEndpointKey=" "properties.networkAcls.bypass=AzureServices" --output none 2>$null if ($LASTEXITCODE -eq 0) { - Write-Host "Successfully disabled public network access on AI Foundry." + Write-Host "Successfully disabled public network access on Azure AI Foundry." } else { Write-Host "Warning: Could not disable public network access. Please disable it manually in Azure Portal." } diff --git a/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.sh b/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.sh index b2dfff31..004e9c23 100644 --- a/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.sh +++ b/infra/scripts/post-provision/agent_scripts/run_create_agents_scripts.sh @@ -137,13 +137,13 @@ enable_public_access() { return 0 fi echo "=== Temporarily enabling public network access for services ===" - # Enable public access for AI Foundry + # Enable public access for Azure AI Foundry # Extract the account resource ID (remove /projects/... part if present) aif_account_resource_id=$(echo "$aiFoundryResourceId" | sed 's|/projects/.*||') aif_resource_name=$(basename "$aif_account_resource_id") - # Extract resource group from the AI Foundry account resource ID + # Extract resource group from the Azure AI Foundry account resource ID aif_resource_group=$(echo "$aif_account_resource_id" | sed -n 's|.*/resourceGroups/\([^/]*\)/.*|\1|p') - # Extract subscription ID from the AI Foundry account resource ID + # Extract subscription ID from the Azure AI Foundry account resource ID aif_subscription_id=$(echo "$aif_account_resource_id" | sed -n 's|.*/subscriptions/\([^/]*\)/.*|\1|p') original_foundry_public_access=$(az cognitiveservices account show \ @@ -153,22 +153,22 @@ enable_public_access() { --query "properties.publicNetworkAccess" \ --output tsv) if [ -z "$original_foundry_public_access" ] || [ "$original_foundry_public_access" = "null" ]; then - echo "⚠ Info: Could not retrieve AI Foundry network access status." - echo " AI Foundry network access might be managed differently." + echo "⚠ Info: Could not retrieve Azure AI Foundry network access status." + echo " Azure AI Foundry network access might be managed differently." elif [ "$original_foundry_public_access" != "Enabled" ]; then - echo "Current AI Foundry public access: $original_foundry_public_access" - echo "Enabling public access for AI Foundry resource: $aif_resource_name (Resource Group: $aif_resource_group)" + echo "Current Azure AI Foundry public access: $original_foundry_public_access" + echo "Enabling public access for Azure AI Foundry resource: $aif_resource_name (Resource Group: $aif_resource_group)" if MSYS_NO_PATHCONV=1 az resource update \ --ids "$aif_account_resource_id" \ --api-version 2024-10-01 \ --set properties.publicNetworkAccess=Enabled properties.apiProperties="{}" \ --output none; then - echo "βœ“ AI Foundry public access enabled" + echo "βœ“ Azure AI Foundry public access enabled" else - echo "⚠ Warning: Failed to enable AI Foundry public access automatically." + echo "⚠ Warning: Failed to enable Azure AI Foundry public access automatically." fi else - echo "βœ“ AI Foundry public access already enabled - no changes needed" + echo "βœ“ Azure AI Foundry public access already enabled - no changes needed" fi if [ -n "$original_foundry_public_access" ] && [ "$original_foundry_public_access" != "Enabled" ]; then @@ -205,10 +205,10 @@ restore_network_access() { fi echo "=== Restoring original network access settings ===" - # Restore AI Foundry access only if it was changed from the original state + # Restore Azure AI Foundry access only if it was changed from the original state if [ -n "$original_foundry_public_access" ] && [ "$original_foundry_public_access" != "Enabled" ]; then - echo "Restoring AI Foundry public access to: $original_foundry_public_access" - # Reconstruct the AI Foundry resource ID for restoration + echo "Restoring Azure AI Foundry public access to: $original_foundry_public_access" + # Reconstruct the Azure AI Foundry resource ID for restoration aif_account_resource_id=$(echo "$aiFoundryResourceId" | sed 's|/projects/.*||') # Try using the working approach to restore the original setting if MSYS_NO_PATHCONV=1 az resource update \ @@ -218,20 +218,20 @@ restore_network_access() { --set properties.apiProperties.qnaAzureSearchEndpointKey="" \ --set properties.networkAcls.bypass="AzureServices" \ --output none 2>/dev/null; then - echo "βœ“ AI Foundry access restored" + echo "βœ“ Azure AI Foundry access restored" else - echo "⚠ Warning: Failed to restore AI Foundry access automatically." + echo "⚠ Warning: Failed to restore Azure AI Foundry access automatically." echo " Please manually restore network access in the Azure portal if needed." fi else - echo "AI Foundry access unchanged (no restoration needed)" + echo "Azure AI Foundry access unchanged (no restoration needed)" fi echo "=== Network access restoration completed ===" } -# Function to assign RBAC roles to the AI Foundry Agent Identity -# The agent identity is created automatically by AI Foundry with the naming pattern: +# Function to assign RBAC roles to the Azure AI Foundry Agent Identity +# The agent identity is created automatically by Azure AI Foundry with the naming pattern: # {aiServicesName}-{projectName}-AgentIdentity assign_agent_identity_roles() { echo "=== Assigning RBAC roles to Agent Identity ===" @@ -293,7 +293,7 @@ assign_agent_identity_roles() { if [[ -z "$agent_principal_id" ]]; then echo "⚠ Warning: Agent identity '$agent_identity_name' not found." - echo " This identity is created automatically by AI Foundry. It may take a few minutes to appear." + echo " This identity is created automatically by Azure AI Foundry. It may take a few minutes to appear." echo " If agents fail with RBAC errors, run this script again or manually assign roles." return 0 # Don't fail the script - identity might be created async fi @@ -307,20 +307,20 @@ assign_agent_identity_roles() { search_service_name=$(echo "$searchEndpoint" | sed -n 's|https://\([^.]*\)\..*|\1|p') search_resource_id="/subscriptions/$azSubscriptionId/resourceGroups/$resource_group/providers/Microsoft.Search/searchServices/$search_service_name" - # Assign Cognitive Services OpenAI User on AI Services account - echo "Assigning 'Cognitive Services OpenAI User' role to agent identity on AI Services..." + # Assign Cognitive Services Azure OpenAI User on AI Services account + echo "Assigning 'Cognitive Services Azure OpenAI User' role to agent identity on AI Services..." if MSYS_NO_PATHCONV=1 az role assignment create \ --assignee "$agent_principal_id" \ --role "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd" \ --scope "$ai_services_resource_id" \ --output none 2>/dev/null; then - echo "βœ“ Cognitive Services OpenAI User role assigned" + echo "βœ“ Cognitive Services Azure OpenAI User role assigned" else echo " Role may already exist or failed to assign" fi - # Assign Search Index Data Reader on AI Search service - echo "Assigning 'Search Index Data Reader' role to agent identity on AI Search..." + # Assign Search Index Data Reader on Azure AI Search service + echo "Assigning 'Search Index Data Reader' role to agent identity on Azure AI Search..." if MSYS_NO_PATHCONV=1 az role assignment create \ --assignee "$agent_principal_id" \ --role "1407120a-92aa-4202-b7e9-c0e197c71c8f" \ @@ -458,7 +458,7 @@ echo "Resource Group: $resource_group" echo "Project Endpoint: $projectEndpoint" echo "Solution Name: $solutionName" echo "GPT Model Name: $gptModelName" -echo "AI Foundry Resource ID: $aiFoundryResourceId" +echo "Azure AI Foundry Resource ID: $aiFoundryResourceId" echo "API App Name: $apiAppName" echo "Search Endpoint: $searchEndpoint" echo "Subscription ID: $azSubscriptionId" @@ -516,7 +516,7 @@ fi # Re-enable exit on error set -e -echo "Checking if the principal has Foundry User role on the AI Foundry" +echo "Checking if the principal has Foundry User role on the Azure AI Foundry" # Foundry may be in a different subscription (BYO), so scope role ops to it. aif_subscription_id=$(echo "$aiFoundryResourceId" | sed -n 's|.*/subscriptions/\([^/]*\)/.*|\1|p') @@ -578,7 +578,7 @@ eval $(echo "$python_output" | grep -E "^(chatAgentName|productAgentName|policyA echo "Agents creation completed." -# Assign RBAC roles to the Agent Identity for OpenAI and Search access +# Assign RBAC roles to the Agent Identity for Azure OpenAI and Search access assign_agent_identity_roles # Update environment variables of API App diff --git a/infra/scripts/post-provision/data_scripts/03_write_products_to_cosmos.py b/infra/scripts/post-provision/data_scripts/03_write_products_to_cosmos.py index 08679408..eb7bd4bd 100644 --- a/infra/scripts/post-provision/data_scripts/03_write_products_to_cosmos.py +++ b/infra/scripts/post-provision/data_scripts/03_write_products_to_cosmos.py @@ -27,7 +27,7 @@ # ENDPOINT = f"https://{os.getenv('AZURE_COSMOSDB_ACCOUNT')}.documents.azure.com:443/" ENDPOINT = f"https://{args.cosmosdb_account}.documents.azure.com:443/" -print(f"Cosmos DB Endpoint: {ENDPOINT}") +print(f"Azure Cosmos DB Endpoint: {ENDPOINT}") DB_NAME = os.getenv("AZURE_COSMOSDB_DATABASE", "ecommerce_db") CONTAINER_NAME = "products" CSV_PATH = str(catalog_csv_path(scenario)) @@ -78,7 +78,7 @@ def normalize_row(row: Dict[str, Any]) -> Dict[str, Any]: if isinstance(v, str): item[k] = v.strip() - # Ensure 'id' exists (Cosmos DB requirement) + # Ensure 'id' exists (Azure Cosmos DB requirement) if not item.get("id"): item["id"] = item.get("productId") or item.get("productId") if not item["id"]: @@ -112,7 +112,7 @@ def upsert_with_retry(container, item: Dict[str, Any], max_retries: int = 6): raise RuntimeError(f"Failed to upsert item after {max_retries} retries") -print("Connecting to Cosmos DB (keyless)...") +print("Connecting to Azure Cosmos DB (keyless)...") database = get_or_create_database(DB_NAME) container = get_or_create_container(database, CONTAINER_NAME, PARTITION_KEY_PATH) diff --git a/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.ps1 b/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.ps1 index a4dcfb00..2e7eed68 100644 --- a/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.ps1 +++ b/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.ps1 @@ -254,9 +254,9 @@ Write-Host "===============================================" Write-Host "Values to be used:" Write-Host "===============================================" Write-Host "Resource Group: $resource_group" -Write-Host "AI Search Endpoint: $ai_search_endpoint" +Write-Host "Azure AI Search Endpoint: $ai_search_endpoint" Write-Host "Azure OpenAI Endpoint: $azure_openai_endpoint" -Write-Host "Cosmos DB Account: $cosmosdb_account" +Write-Host "Azure Cosmos DB Account: $cosmosdb_account" Write-Host "Subscription ID: $azSubscriptionId" Write-Host "===============================================" Write-Host "" @@ -264,7 +264,7 @@ Write-Host "" Write-Host "Getting signed in user id" $signed_user_id = az ad signed-in-user show --query id -o tsv -Write-Host "Checking if the user has Search roles on the AI Search Service" +Write-Host "Checking if the user has Search roles on the Azure AI Search Service" # search service contributor role id: 7ca78c08-252a-4471-8644-bb5ff32d4ba0 # search index data contributor role id: 8ebe5a00-799e-43f5-93ac-243d3dce84a7 # search index data reader role id: 1407120a-92aa-4202-b7e9-c0e197c71c8f @@ -376,8 +376,8 @@ if ([string]::IsNullOrEmpty($role_assignment)) { Write-Host "User already has the Azure AI Developer role." } -# Check if the user has the Cosmos DB Built-in Data Contributor role -Write-Host "Checking if user has the Cosmos DB Built-in Data Contributor role" +# Check if the user has the Azure Cosmos DB Built-in Data Contributor role +Write-Host "Checking if user has the Azure Cosmos DB Built-in Data Contributor role" $roleExists = az cosmosdb sql role assignment list ` --resource-group $resource_group ` --account-name $cosmosdb_account ` @@ -385,9 +385,9 @@ $roleExists = az cosmosdb sql role assignment list ` # Check if the role exists if (![string]::IsNullOrEmpty($roleExists)) { - Write-Host "User already has the Cosmos DB Built-in Data Contributer role." + Write-Host "User already has the Azure Cosmos DB Built-in Data contributor role." } else { - Write-Host "User does not have the Cosmos DB Built-in Data Contributer role. Assigning the role." + Write-Host "User does not have the Azure Cosmos DB Built-in Data contributor role. Assigning the role." az cosmosdb sql role assignment create ` --resource-group $resource_group ` --account-name $cosmosdb_account ` @@ -397,11 +397,11 @@ if (![string]::IsNullOrEmpty($roleExists)) { --output none if ($LASTEXITCODE -eq 0) { - Write-Host "Cosmos DB Built-in Data Contributer role assigned successfully." + Write-Host "Azure Cosmos DB Built-in Data contributor role assigned successfully." Write-Host "Waiting 10 seconds for role propagation..." Start-Sleep -Seconds 10 } else { - Write-Host "Failed to assign Cosmos DB Built-in Data Contributer role." + Write-Host "Failed to assign Azure Cosmos DB Built-in Data contributor role." } } @@ -413,7 +413,7 @@ if (![string]::IsNullOrEmpty($roleExists)) { # --query "[].roleDefinitionId" -o tsv # if ([string]::IsNullOrEmpty($role_assignment)) { -# Write-Host "User does not have the Cosmos DB account contributor role. Assigning the role..." +# Write-Host "User does not have the Azure Cosmos DB account contributor role. Assigning the role..." # az role assignment create ` # --assignee "$signed_user_id" ` # --role "00000000-0000-0000-0000-000000000002" ` @@ -421,13 +421,13 @@ if (![string]::IsNullOrEmpty($roleExists)) { # --output none # if ($LASTEXITCODE -eq 0) { -# Write-Host "Cosmos DB account contributor role assigned successfully." +# Write-Host "Azure Cosmos DB account contributor role assigned successfully." # } else { -# Write-Host "Failed to assign Cosmos DB account contributor role." +# Write-Host "Failed to assign Azure Cosmos DB account contributor role." # exit 1 # } # } else { -# Write-Host "User already has the Cosmos DB account contributor role." +# Write-Host "User already has the Azure Cosmos DB account contributor role." # } # $role_assignment = az cosmosdb sql role assignment list ` @@ -438,7 +438,7 @@ if (![string]::IsNullOrEmpty($roleExists)) { # --query "[].roleDefinitionId" -o tsv # if ([string]::IsNullOrEmpty($role_assignment)) { -# Write-Host "User does not have the Cosmos DB SQL role. Assigning the role..." +# Write-Host "User does not have the Azure Cosmos DB SQL role. Assigning the role..." # az cosmosdb sql role assignment create ` # --account-name "$cosmosdb_account" ` # --resource-group "$resource_group" ` @@ -448,13 +448,13 @@ if (![string]::IsNullOrEmpty($roleExists)) { # --output none # if ($LASTEXITCODE -eq 0) { -# Write-Host "Cosmos DB SQL role assigned successfully." +# Write-Host "Azure Cosmos DB SQL role assigned successfully." # } else { -# Write-Host "Failed to assign Cosmos DB SQL role." +# Write-Host "Failed to assign Azure Cosmos DB SQL role." # exit 1 # } # } else { -# Write-Host "User already has the Cosmos DB SQL role." +# Write-Host "User already has the Azure Cosmos DB SQL role." # } # python -m venv .venv @@ -467,17 +467,17 @@ Write-Host "Installing Python requirements..." python -m pip install --upgrade pip python -m pip install --quiet -r "$requirementFile" -# For WAF deployments, temporarily enable public network access on AI Foundry (needed for embeddings) -Write-Host "=== Checking AI Foundry network access for embeddings ===" +# For WAF deployments, temporarily enable public network access on Azure AI Foundry (needed for embeddings) +Write-Host "=== Checking Azure AI Foundry network access for embeddings ===" -# Extract the AI Foundry account resource ID (remove /projects/... part if present) +# Extract the Azure AI Foundry account resource ID (remove /projects/... part if present) $aifAccountResourceId = $aiFoundryResourceId -replace '/projects/.*', '' $aifResourceName = Split-Path -Leaf $aifAccountResourceId -# Extract resource group from the AI Foundry account resource ID +# Extract resource group from the Azure AI Foundry account resource ID if ($aifAccountResourceId -match '/resourceGroups/([^/]+)/') { $aifResourceGroup = $Matches[1] } -# Extract subscription ID from the AI Foundry account resource ID +# Extract subscription ID from the Azure AI Foundry account resource ID if ($aifAccountResourceId -match '/subscriptions/([^/]+)/') { $aifSubscriptionId = $Matches[1] } @@ -488,11 +488,11 @@ $foundryAccessEnabled = $false # Check if public network access is disabled (WAF deployment) if ($originalFoundryPublicAccess -eq "Disabled") { - Write-Host "AI Foundry public network access is disabled. Temporarily enabling for embeddings..." + Write-Host "Azure AI Foundry public network access is disabled. Temporarily enabling for embeddings..." az resource update --ids $aifAccountResourceId --api-version 2024-10-01 --set "properties.publicNetworkAccess=Enabled" "properties.apiProperties={}" --output none 2>$null if ($LASTEXITCODE -eq 0) { - Write-Host "Successfully enabled public network access on AI Foundry." + Write-Host "Successfully enabled public network access on Azure AI Foundry." $foundryAccessEnabled = $true } else { Write-Host "Warning: Could not enable public network access. Embeddings may fail." @@ -502,27 +502,27 @@ if ($originalFoundryPublicAccess -eq "Disabled") { Write-Host "Waiting for network settings to propagate (60 seconds)..." Start-Sleep -Seconds 60 } else { - Write-Host "AI Foundry public network access is already enabled." + Write-Host "Azure AI Foundry public network access is already enabled." } -Write-Host "=== AI Foundry network access check completed ===" +Write-Host "=== Azure AI Foundry network access check completed ===" # Run Python scripts Write-Host "Running data upload scripts for scenario: $deploymentScenario" python infra/scripts/post-provision/data_scripts/01_create_products_search_index.py --ai_search_endpoint="$ai_search_endpoint" --azure_openai_endpoint="$azure_openai_endpoint" --embedding_model_name="$embedding_model_name" --scenario="$deploymentScenario" python infra/scripts/post-provision/data_scripts/02_create_policies_search_index.py --ai_search_endpoint="$ai_search_endpoint" --azure_openai_endpoint="$azure_openai_endpoint" --embedding_model_name="$embedding_model_name" --scenario="$deploymentScenario" -# For WAF deployments, temporarily enable public network access on Cosmos DB -Write-Host "=== Temporarily enabling public network access for Cosmos DB ===" -Write-Host "Configuring Cosmos DB network access: $cosmosdb_account" +# For WAF deployments, temporarily enable public network access on Azure Cosmos DB +Write-Host "=== Temporarily enabling public network access for Azure Cosmos DB ===" +Write-Host "Configuring Azure Cosmos DB network access: $cosmosdb_account" -# Get Cosmos DB resource ID +# Get Azure Cosmos DB resource ID $subscription_id = az account show --query id -o tsv $cosmos_resource_id = "/subscriptions/${subscription_id}/resourceGroups/${resource_group}/providers/Microsoft.DocumentDB/databaseAccounts/${cosmosdb_account}" # Get current public network access setting $originalCosmosPublicAccess = az resource show --ids $cosmos_resource_id --api-version 2021-04-15 --query "properties.publicNetworkAccess" -o tsv 2>$null -Write-Host "Original Cosmos DB public access: $originalCosmosPublicAccess" +Write-Host "Original Azure Cosmos DB public access: $originalCosmosPublicAccess" $cosmosAccessEnabled = $false # Capture existing firewall rules up front so they can be restored accurately, @@ -533,12 +533,12 @@ if (-not $originalCosmosIpFilter) { $originalCosmosIpFilter = "[]" } -# Only modify Cosmos DB if it's not already enabled +# Only modify Azure Cosmos DB if it's not already enabled if ($originalCosmosPublicAccess -eq "Enabled") { - Write-Host "βœ“ Cosmos DB public access already enabled - no changes needed" + Write-Host "βœ“ Azure Cosmos DB public access already enabled - no changes needed" } else { if ($ipFilterReadFailed) { - throw "Failed to read existing Cosmos DB firewall rules (az resource show exit code $LASTEXITCODE); aborting before any network changes to avoid wiping them on restore." + throw "Failed to read existing Azure Cosmos DB firewall rules (az resource show exit code $LASTEXITCODE); aborting before any network changes to avoid wiping them on restore." } # Determine the IP to whitelist. In proxy/VPN environments the auto-detected # IP can differ from the IP Cosmos actually sees, so allow an explicit override @@ -556,36 +556,36 @@ if ($originalCosmosPublicAccess -eq "Enabled") { Write-Host "Current IP: $currentIp" } - Write-Host "Cosmos DB public access is '$originalCosmosPublicAccess' - enabling access" + Write-Host "Azure Cosmos DB public access is '$originalCosmosPublicAccess' - enabling access" # Add the detected/override IP(s) to firewall rules and enable public network access. # Supports a comma-separated list of IPs/CIDRs via COSMOS_FIREWALL_IP. $cosmosIpList = @($currentIp -split ',' | ForEach-Object { $_.Trim() } | Where-Object { $_ }) if ($cosmosIpList.Count -eq 0) { - throw "Could not determine an IP to whitelist for the Cosmos DB firewall (auto-detection failed and COSMOS_FIREWALL_IP is not set). Set COSMOS_FIREWALL_IP to an explicit IP/CIDR (or comma-separated list) and re-run. Refusing to enable public access with an empty firewall rule set." + throw "Could not determine an IP to whitelist for the Azure Cosmos DB firewall (auto-detection failed and COSMOS_FIREWALL_IP is not set). Set COSMOS_FIREWALL_IP to an explicit IP/CIDR (or comma-separated list) and re-run. Refusing to enable public access with an empty firewall rule set." } - Write-Host "Adding IP(s) to Cosmos DB firewall: $($cosmosIpList -join ', ')" + Write-Host "Adding IP(s) to Azure Cosmos DB firewall: $($cosmosIpList -join ', ')" $ipRuleJson = "[" + (($cosmosIpList | ForEach-Object { "{\`"ipAddressOrRange\`":\`"$_\`"}" }) -join ",") + "]" az resource update --ids $cosmos_resource_id --api-version 2021-04-15 --set "properties.ipRules=$ipRuleJson" --set "properties.publicNetworkAccess=Enabled" --output none 2>$null if ($LASTEXITCODE -eq 0) { - Write-Host "βœ“ Cosmos DB firewall updated to allow current IP" - Write-Host "βœ“ Cosmos DB public network access enabled" + Write-Host "βœ“ Azure Cosmos DB firewall updated to allow current IP" + Write-Host "βœ“ Azure Cosmos DB public network access enabled" $cosmosAccessEnabled = $true # Wait for changes to propagate - Write-Host "Waiting for Cosmos DB network changes to take effect (30 seconds)..." + Write-Host "Waiting for Azure Cosmos DB network changes to take effect (30 seconds)..." Start-Sleep -Seconds 30 Write-Host "Network configuration should now be active" } else { - Write-Host "⚠ Warning: Failed to update Cosmos DB firewall. You may need to manually add IP $currentIp" - Write-Host " Please add this IP address in Azure Portal: Cosmos DB > $cosmosdb_account > Networking > Firewall" + Write-Host "⚠ Warning: Failed to update Azure Cosmos DB firewall. You may need to manually add IP $currentIp" + Write-Host " Please add this IP address in Azure Portal: Azure Cosmos DB > $cosmosdb_account > Networking > Firewall" } } Write-Host "=== Public network access enabled successfully ===" -# Run the Cosmos DB upload script within try/finally to ensure network settings are restored on error +# Run the Azure Cosmos DB upload script within try/finally to ensure network settings are restored on error $dataUploadFailed = $false try { $cosmosUploadSuccess = $false @@ -605,10 +605,10 @@ try { $ipMatch = [regex]::Match($uploadText, 'originated from IP (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})') if ($ipMatch.Success -and $attempt -lt $maxUploadAttempts) { $blockedIp = $ipMatch.Groups[1].Value - Write-Host "Cosmos DB firewall blocked actual egress IP $blockedIp - adding it and retrying (attempt $attempt of $maxUploadAttempts)..." + Write-Host "Azure Cosmos DB firewall blocked actual egress IP $blockedIp - adding it and retrying (attempt $attempt of $maxUploadAttempts)..." $existingIps = az resource show --ids $cosmos_resource_id --api-version 2021-04-15 --query "properties.ipRules[].ipAddressOrRange" -o tsv 2>$null if ($LASTEXITCODE -ne 0) { - throw "Failed to read existing Cosmos DB firewall rules (az resource show exit code $LASTEXITCODE); aborting recovery to avoid overwriting existing rules." + throw "Failed to read existing Azure Cosmos DB firewall rules (az resource show exit code $LASTEXITCODE); aborting recovery to avoid overwriting existing rules." } $ipList = @() if ($existingIps) { $ipList = @($existingIps -split "\r?\n" | Where-Object { $_ }) } @@ -616,21 +616,21 @@ try { $retryIpRuleJson = "[" + (($ipList | ForEach-Object { "{\`"ipAddressOrRange\`":\`"$_\`"}" }) -join ",") + "]" $updateError = az resource update --ids $cosmos_resource_id --api-version 2021-04-15 --set "properties.ipRules=$retryIpRuleJson" --set "properties.publicNetworkAccess=Enabled" --output none 2>&1 if ($LASTEXITCODE -ne 0) { - throw "Failed to add blocked IP $blockedIp to the Cosmos DB firewall (az resource update exit code $LASTEXITCODE): $($updateError | Out-String)" + throw "Failed to add blocked IP $blockedIp to the Azure Cosmos DB firewall (az resource update exit code $LASTEXITCODE): $($updateError | Out-String)" } $cosmosAccessEnabled = $true - Write-Host "Waiting for Cosmos DB network changes to take effect (30 seconds)..." + Write-Host "Waiting for Azure Cosmos DB network changes to take effect (30 seconds)..." Start-Sleep -Seconds 30 } else { break } } if (-not $cosmosUploadSuccess) { - throw "Cosmos DB upload script failed with exit code $uploadExitCode" + throw "Azure Cosmos DB upload script failed with exit code $uploadExitCode" } } catch { - Write-Host "Error running Cosmos DB upload script: $_" + Write-Host "Error running Azure Cosmos DB upload script: $_" $dataUploadFailed = $true } finally { @@ -638,12 +638,12 @@ finally { Write-Host "=== Restoring original network access settings ===" if ($cosmosAccessEnabled) { - Write-Host "Restoring Cosmos DB settings..." + Write-Host "Restoring Azure Cosmos DB settings..." # Restore both firewall rules and public access setting $restoreSuccess = $false if ($originalCosmosPublicAccess -and $originalCosmosPublicAccess -ne "null") { - Write-Host "Restoring Cosmos DB public access to: $originalCosmosPublicAccess" + Write-Host "Restoring Azure Cosmos DB public access to: $originalCosmosPublicAccess" az resource update --ids $cosmos_resource_id --api-version 2021-04-15 --set "properties.ipRules=$originalCosmosIpFilter" --set "properties.publicNetworkAccess=$originalCosmosPublicAccess" --output none 2>$null $restoreSuccess = ($LASTEXITCODE -eq 0) } else { @@ -652,26 +652,26 @@ finally { } if ($restoreSuccess) { - Write-Host "βœ“ Cosmos DB settings restored" + Write-Host "βœ“ Azure Cosmos DB settings restored" } else { - Write-Host "⚠ Warning: Failed to restore Cosmos DB settings automatically." + Write-Host "⚠ Warning: Failed to restore Azure Cosmos DB settings automatically." Write-Host " Please manually check firewall and network settings in the Azure portal." } } else { - Write-Host "Cosmos DB unchanged (no restoration needed)" + Write-Host "Azure Cosmos DB unchanged (no restoration needed)" } - # Restore AI Foundry access if we enabled it + # Restore Azure AI Foundry access if we enabled it if ($foundryAccessEnabled) { - Write-Host "Restoring original AI Foundry settings (disabling public network access)..." + Write-Host "Restoring original Azure AI Foundry settings (disabling public network access)..." az resource update --ids $aifAccountResourceId --api-version 2024-10-01 --set "properties.publicNetworkAccess=Disabled" "properties.apiProperties.qnaAzureSearchEndpointKey=" "properties.networkAcls.bypass=AzureServices" --output none 2>$null if ($LASTEXITCODE -eq 0) { - Write-Host "βœ“ AI Foundry public network access restored (disabled)." + Write-Host "βœ“ Azure AI Foundry public network access restored (disabled)." } else { - Write-Host "⚠ Warning: Could not disable AI Foundry public network access. Please disable it manually in Azure Portal." + Write-Host "⚠ Warning: Could not disable Azure AI Foundry public network access. Please disable it manually in Azure Portal." } } else { - Write-Host "AI Foundry unchanged (no restoration needed)" + Write-Host "Azure AI Foundry unchanged (no restoration needed)" } Write-Host "=== Network access restoration completed ===" diff --git a/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.sh b/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.sh index a15dc30e..cfd2eba8 100644 --- a/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.sh +++ b/infra/scripts/post-provision/data_scripts/run_upload_data_scripts.sh @@ -142,10 +142,10 @@ enable_public_access() { return 0 fi echo "=== Temporarily enabling public network access for services ===" - # Enable public access for Cosmos DB - echo "Configuring Cosmos DB network access: $cosmosdb_account" + # Enable public access for Azure Cosmos DB + echo "Configuring Azure Cosmos DB network access: $cosmosdb_account" - # Get Cosmos DB resource ID + # Get Azure Cosmos DB resource ID subscription_id=$(az account show --query id -o tsv) cosmos_resource_id="/subscriptions/${subscription_id}/resourceGroups/${resource_group}/providers/Microsoft.DocumentDB/databaseAccounts/${cosmosdb_account}" @@ -154,11 +154,11 @@ enable_public_access() { --api-version 2021-04-15 \ --query "properties.publicNetworkAccess" \ --output tsv 2>/dev/null) - echo "Original Cosmos DB public access: $original_cosmos_public_access" + echo "Original Azure Cosmos DB public access: $original_cosmos_public_access" - # Only modify Cosmos DB if it's not already enabled + # Only modify Azure Cosmos DB if it's not already enabled if [ "$original_cosmos_public_access" = "Enabled" ]; then - echo "βœ“ Cosmos DB public access already enabled - no changes needed" + echo "βœ“ Azure Cosmos DB public access already enabled - no changes needed" else # Abort if the read fails so restore never wipes rules with an empty set. echo "Getting current firewall configuration..." @@ -168,13 +168,13 @@ enable_public_access() { --query "properties.ipRules" \ --output json 2>/dev/null) if [ $? -ne 0 ]; then - echo "Error: Failed to read existing Cosmos DB firewall rules; aborting before any network changes to avoid wiping them on restore." >&2 + echo "Error: Failed to read existing Azure Cosmos DB firewall rules; aborting before any network changes to avoid wiping them on restore." >&2 # No changes were made yet, so skip the restore trap (it would write ipRules=[]). trap - EXIT INT TERM exit 1 fi - echo "Cosmos DB public access is '$original_cosmos_public_access' - enabling access" + echo "Azure Cosmos DB public access is '$original_cosmos_public_access' - enabling access" if [ -n "$COSMOS_FIREWALL_IP" ]; then # Explicit override for proxy/VPN environments where the auto-detected IP @@ -219,7 +219,7 @@ enable_public_access() { exit 1 fi - echo "Adding multiple IPs to Cosmos DB firewall to handle NAT/proxy variations..." + echo "Adding multiple IPs to Azure Cosmos DB firewall to handle NAT/proxy variations..." echo " Base IP: $current_ip" # Build JSON array with current IP and Β±2 range @@ -245,26 +245,26 @@ enable_public_access() { --set "properties.ipRules=$ip_rules" \ --set "properties.publicNetworkAccess=Enabled" \ --output none; then - echo "βœ“ Cosmos DB firewall updated with multiple IPs for NAT handling" - echo "βœ“ Cosmos DB public network access enabled" + echo "βœ“ Azure Cosmos DB firewall updated with multiple IPs for NAT handling" + echo "βœ“ Azure Cosmos DB public network access enabled" # Wait longer for changes to propagate - echo "Waiting for Cosmos DB network changes to take effect..." + echo "Waiting for Azure Cosmos DB network changes to take effect..." sleep 30 echo "Network configuration should now be active" else - echo "⚠ Warning: Failed to update Cosmos DB firewall. You may need to manually add IP $current_ip" - echo " Please add this IP address in Azure Portal: Cosmos DB > $cosmosdb_account > Networking > Firewall" + echo "⚠ Warning: Failed to update Azure Cosmos DB firewall. You may need to manually add IP $current_ip" + echo " Please add this IP address in Azure Portal: Azure Cosmos DB > $cosmosdb_account > Networking > Firewall" fi fi - # Enable public access for AI Foundry + # Enable public access for Azure AI Foundry # Extract the account resource ID (remove /projects/... part if present) aif_account_resource_id=$(echo "$aiFoundryResourceId" | sed 's|/projects/.*||') aif_resource_name=$(basename "$aif_account_resource_id") - # Extract resource group from the AI Foundry account resource ID + # Extract resource group from the Azure AI Foundry account resource ID aif_resource_group=$(echo "$aif_account_resource_id" | sed -n 's|.*/resourceGroups/\([^/]*\)/.*|\1|p') - # Extract subscription ID from the AI Foundry account resource ID + # Extract subscription ID from the Azure AI Foundry account resource ID aif_subscription_id=$(echo "$aif_account_resource_id" | sed -n 's|.*/subscriptions/\([^/]*\)/.*|\1|p') original_foundry_public_access=$(az cognitiveservices account show \ @@ -274,22 +274,22 @@ enable_public_access() { --query "properties.publicNetworkAccess" \ --output tsv) if [ -z "$original_foundry_public_access" ] || [ "$original_foundry_public_access" = "null" ]; then - echo "⚠ Info: Could not retrieve AI Foundry network access status." - echo " AI Foundry network access might be managed differently." + echo "⚠ Info: Could not retrieve Azure AI Foundry network access status." + echo " Azure AI Foundry network access might be managed differently." elif [ "$original_foundry_public_access" != "Enabled" ]; then - echo "Current AI Foundry public access: $original_foundry_public_access" - echo "Enabling public access for AI Foundry resource: $aif_resource_name (Resource Group: $aif_resource_group)" + echo "Current Azure AI Foundry public access: $original_foundry_public_access" + echo "Enabling public access for Azure AI Foundry resource: $aif_resource_name (Resource Group: $aif_resource_group)" if MSYS_NO_PATHCONV=1 az resource update \ --ids "$aif_account_resource_id" \ --api-version 2024-10-01 \ --set properties.publicNetworkAccess=Enabled properties.apiProperties="{}" \ --output none; then - echo "βœ“ AI Foundry public access enabled" + echo "βœ“ Azure AI Foundry public access enabled" else - echo "⚠ Warning: Failed to enable AI Foundry public access automatically." + echo "⚠ Warning: Failed to enable Azure AI Foundry public access automatically." fi else - echo "βœ“ AI Foundry public access already enabled - no changes needed" + echo "βœ“ Azure AI Foundry public access already enabled - no changes needed" fi # Wait a bit for changes to take effect @@ -314,10 +314,10 @@ restore_network_access() { : "${original_cosmos_public_access:=${ORIGINAL_COSMOS_PUBLIC_ACCESS:-}}" : "${original_cosmos_ip_filter:=${ORIGINAL_COSMOS_IP_FILTER:-[]}}" : "${original_foundry_public_access:=${ORIGINAL_FOUNDRY_PUBLIC_ACCESS:-}}" - # Restore AI Foundry access only if it was changed from the original state + # Restore Azure AI Foundry access only if it was changed from the original state if [ -n "$original_foundry_public_access" ] && [ "$original_foundry_public_access" != "Enabled" ]; then - echo "Restoring AI Foundry public access to: $original_foundry_public_access" - # Reconstruct the AI Foundry resource ID for restoration + echo "Restoring Azure AI Foundry public access to: $original_foundry_public_access" + # Reconstruct the Azure AI Foundry resource ID for restoration aif_account_resource_id=$(echo "$aiFoundryResourceId" | sed 's|/projects/.*||') # Try using the working approach to restore the original setting if MSYS_NO_PATHCONV=1 az resource update \ @@ -327,22 +327,22 @@ restore_network_access() { --set properties.apiProperties.qnaAzureSearchEndpointKey="" \ --set properties.networkAcls.bypass="AzureServices" \ --output none 2>/dev/null; then - echo "βœ“ AI Foundry access restored" + echo "βœ“ Azure AI Foundry access restored" else - echo "⚠ Warning: Failed to restore AI Foundry access automatically." + echo "⚠ Warning: Failed to restore Azure AI Foundry access automatically." echo " Please manually restore network access in the Azure portal if needed." fi else - echo "AI Foundry access unchanged (no restoration needed)" + echo "Azure AI Foundry access unchanged (no restoration needed)" fi - # Restore Cosmos DB settings only if it was changed from the original state + # Restore Azure Cosmos DB settings only if it was changed from the original state if [ -n "$original_cosmos_public_access" ] && [ "$original_cosmos_public_access" != "Enabled" ] && [ "$original_cosmos_public_access" != "null" ]; then - echo "Restoring Cosmos DB settings..." + echo "Restoring Azure Cosmos DB settings..." subscription_id=$(az account show --query id -o tsv) cosmos_resource_id="/subscriptions/${subscription_id}/resourceGroups/${resource_group}/providers/Microsoft.DocumentDB/databaseAccounts/${cosmosdb_account}" - echo "Restoring Cosmos DB public access to: $original_cosmos_public_access" + echo "Restoring Azure Cosmos DB public access to: $original_cosmos_public_access" # Use separate az resource update calls to avoid JSON parsing issues # First, restore public network access @@ -352,13 +352,13 @@ restore_network_access() { --set "properties.publicNetworkAccess=$original_cosmos_public_access" \ --set "properties.ipRules=$original_cosmos_ip_filter" \ --output none 2>/dev/null; then - echo "βœ“ Cosmos DB settings restored" + echo "βœ“ Azure Cosmos DB settings restored" else - echo "⚠ Warning: Failed to restore Cosmos DB settings automatically." + echo "⚠ Warning: Failed to restore Azure Cosmos DB settings automatically." echo " Please manually check firewall and network settings in the Azure portal." fi else - echo "Cosmos DB unchanged (no restoration needed)" + echo "Azure Cosmos DB unchanged (no restoration needed)" fi echo "=== Network access restoration completed ===" @@ -480,9 +480,9 @@ echo "===============================================" echo "Values to be used:" echo "===============================================" echo "Resource Group: $resource_group" -echo "AI Search Endpoint: $ai_search_endpoint" +echo "Azure AI Search Endpoint: $ai_search_endpoint" echo "Azure OpenAI Endpoint: $azure_openai_endpoint" -echo "Cosmos DB Account: $cosmosdb_account" +echo "Azure Cosmos DB Account: $cosmosdb_account" echo "Subscription ID: $azSubscriptionId" echo "===============================================" echo "" @@ -537,7 +537,7 @@ fi set -e if [ "$SKIP_ROLE_ASSIGNMENT" != "true" ] && [ -n "$signed_user_id" ]; then - echo "Checking if the principal has Search roles on the AI Search Service" + echo "Checking if the principal has Search roles on the Azure AI Search Service" # search service contributor role id: 7ca78c08-252a-4471-8644-bb5ff32d4ba0 # search index data contributor role id: 8ebe5a00-799e-43f5-93ac-243d3dce84a7 # search index data reader role id: 1407120a-92aa-4202-b7e9-c0e197c71c8f @@ -650,8 +650,8 @@ if [ "$SKIP_ROLE_ASSIGNMENT" != "true" ] && [ -n "$signed_user_id" ]; then echo "Principal already has the Azure AI Developer role." fi - # Check if the principal has the Cosmos DB Built-in Data Contributor role - echo "Checking if principal has the Cosmos DB Built-in Data Contributor role" + # Check if the principal has the Azure Cosmos DB Built-in Data Contributor role + echo "Checking if principal has the Azure Cosmos DB Built-in Data Contributor role" roleExists=$(az cosmosdb sql role assignment list \ --resource-group $resource_group \ --account-name $cosmosdb_account \ @@ -659,9 +659,9 @@ if [ "$SKIP_ROLE_ASSIGNMENT" != "true" ] && [ -n "$signed_user_id" ]; then # Check if the role exists if [ -n "$roleExists" ]; then - echo "Principal already has the Cosmos DB Built-in Data Contributer role." + echo "Principal already has the Azure Cosmos DB Built-in Data contributor role." else - echo "Principal does not have the Cosmos DB Built-in Data Contributer role. Assigning the role." + echo "Principal does not have the Azure Cosmos DB Built-in Data contributor role. Assigning the role." MSYS_NO_PATHCONV=1 az cosmosdb sql role assignment create \ --resource-group $resource_group \ --account-name $cosmosdb_account \ @@ -670,11 +670,11 @@ if [ "$SKIP_ROLE_ASSIGNMENT" != "true" ] && [ -n "$signed_user_id" ]; then --scope "/" \ --output none if [ $? -eq 0 ]; then - echo "Cosmos DB Built-in Data Contributer role assigned successfully." + echo "Azure Cosmos DB Built-in Data contributor role assigned successfully." echo "Waiting 10 seconds for role propagation..." sleep 10 else - echo "Failed to assign Cosmos DB Built-in Data Contributer role." + echo "Failed to assign Azure Cosmos DB Built-in Data contributor role." fi fi else @@ -688,7 +688,7 @@ fi # --query "[].roleDefinitionId" -o tsv) # if [ -z "$role_assignment" ]; then -# echo "User does not have the Cosmos DB account contributor role. Assigning the role..." +# echo "User does not have the Azure Cosmos DB account contributor role. Assigning the role..." # MSYS_NO_PATHCONV=1 az role assignment create \ # --assignee "$signed_user_id" \ # --role "00000000-0000-0000-0000-000000000002" \ @@ -696,13 +696,13 @@ fi # --output none # if [ $? -eq 0 ]; then -# echo "Cosmos DB account contributor role assigned successfully." +# echo "Azure Cosmos DB account contributor role assigned successfully." # else -# echo "Failed to assign Cosmos DB account contributor role." +# echo "Failed to assign Azure Cosmos DB account contributor role." # exit 1 # fi # else -# echo "User already has the Cosmos DB account contributor role." +# echo "User already has the Azure Cosmos DB account contributor role." # fi # role_assignment=$(MSYS_NO_PATHCONV=1 az cosmosdb sql role assignment list \ @@ -713,7 +713,7 @@ fi # --query "[].roleDefinitionId" -o tsv) # if [ -z "$role_assignment" ]; then -# echo "User does not have the Cosmos DB SQL role. Assigning the role..." +# echo "User does not have the Azure Cosmos DB SQL role. Assigning the role..." # MSYS_NO_PATHCONV=1 az cosmosdb sql role assignment create \ # --account-name "$cosmosdb_account" \ # --resource-group "$resource_group" \ @@ -723,13 +723,13 @@ fi # --output none # if [ $? -eq 0 ]; then -# echo "Cosmos DB SQL role assigned successfully." +# echo "Azure Cosmos DB SQL role assigned successfully." # else -# echo "Failed to assign Cosmos DB SQL role." +# echo "Failed to assign Azure Cosmos DB SQL role." # exit 1 # fi # else -# echo "User already has the Cosmos DB SQL role." +# echo "User already has the Azure Cosmos DB SQL role." # fi # python -m venv .venv @@ -767,11 +767,11 @@ while true; do fi blocked_ip=$(echo "$upload_output" | grep -oE 'originated from IP [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | head -n1) if [ -n "$blocked_ip" ] && [ $upload_attempt -lt $max_upload_attempts ]; then - echo "Cosmos DB firewall blocked actual egress IP $blocked_ip - adding it and retrying (attempt $upload_attempt of $max_upload_attempts)..." + echo "Azure Cosmos DB firewall blocked actual egress IP $blocked_ip - adding it and retrying (attempt $upload_attempt of $max_upload_attempts)..." existing_ips=$(MSYS_NO_PATHCONV=1 az resource show --ids "$cosmos_resource_id" --api-version 2021-04-15 --query "properties.ipRules[].ipAddressOrRange" --output tsv 2>/dev/null) existing_ips_rc=$? if [ $existing_ips_rc -ne 0 ]; then - echo "Error: Failed to read existing Cosmos DB firewall rules; aborting recovery to avoid overwriting them." >&2 + echo "Error: Failed to read existing Azure Cosmos DB firewall rules; aborting recovery to avoid overwriting them." >&2 break fi existing_ips=$(printf '%s' "$existing_ips" | tr -d '\r') @@ -789,16 +789,16 @@ while true; do retry_rules="${retry_rules}]" update_err=$(MSYS_NO_PATHCONV=1 az resource update --ids "$cosmos_resource_id" --api-version 2021-04-15 --set "properties.ipRules=$retry_rules" --set "properties.publicNetworkAccess=Enabled" --output none 2>&1) if [ $? -ne 0 ]; then - echo "Error: Failed to add blocked IP $blocked_ip to the Cosmos DB firewall. Aborting retries." >&2 + echo "Error: Failed to add blocked IP $blocked_ip to the Azure Cosmos DB firewall. Aborting retries." >&2 echo "$update_err" >&2 break fi - echo "Waiting for Cosmos DB network changes to take effect (30 seconds)..." + echo "Waiting for Azure Cosmos DB network changes to take effect (30 seconds)..." sleep 30 upload_attempt=$((upload_attempt + 1)) continue fi - echo "Error: Cosmos DB upload failed (exit code $upload_rc) and could not be recovered." + echo "Error: Azure Cosmos DB upload failed (exit code $upload_rc) and could not be recovered." break done set -e @@ -806,4 +806,4 @@ if [ $upload_rc -ne 0 ]; then exit $upload_rc fi -echo "Network access will be restored to original settings..." \ No newline at end of file +echo "Network access will be restored to original settings..." diff --git a/scenario-app/backend/.dockerignore b/scenario-app/backend/.dockerignore index fe4bc8d7..449c9bca 100644 --- a/scenario-app/backend/.dockerignore +++ b/scenario-app/backend/.dockerignore @@ -31,3 +31,14 @@ Thumbs.db # VCS .git/ .gitignore + +.env +.env.* +!.env.example +__pycache__ +*.pyc +.venv +venv +.pytest_cache +.mypy_cache +*.md diff --git a/scenario-app/backend/README.md b/scenario-app/backend/README.md index ff3f752e..4cb083c2 100644 --- a/scenario-app/backend/README.md +++ b/scenario-app/backend/README.md @@ -7,7 +7,7 @@ FastAPI backend for the e-commerce chat application with AI-powered customer sup - **Product Management**: CRUD operations for products with filtering and search - **AI Chat**: Azure OpenAI integration with fallback responses - **Shopping Cart**: Full cart management functionality -- **Database Support**: Cosmos DB integration with mock data fallback +- **Database Support**: Azure Cosmos DB integration with mock data fallback - **Authentication**: Microsoft Entra ID integration (ready for implementation) - **API Documentation**: Interactive Swagger/OpenAPI docs - **Testing**: Comprehensive unit tests @@ -23,7 +23,7 @@ backend/ β”‚ β”œβ”€β”€ config.py # Configuration management β”‚ β”œβ”€β”€ models.py # Pydantic models β”‚ β”œβ”€β”€ database.py # Database abstraction layer -β”‚ β”œβ”€β”€ cosmos_service.py # Cosmos DB implementation +β”‚ β”œβ”€β”€ cosmos_service.py # Azure Cosmos DB implementation β”‚ β”œβ”€β”€ ai_service.py # Azure OpenAI integration β”‚ └── routers/ β”‚ β”œβ”€β”€ products.py # Product endpoints @@ -140,7 +140,7 @@ The backend supports two database modes: - No external dependencies - Perfect for local development and testing -### 2. Cosmos DB (Production) +### 2. Azure Cosmos DB (Production) - Azure Cosmos DB integration - Persistent storage - Scalable and production-ready @@ -163,7 +163,7 @@ The backend supports two database modes: The application uses environment-based configuration with sensible defaults: -- **Database**: Automatically detects Cosmos DB configuration +- **Database**: Automatically detects Azure Cosmos DB configuration - **AI Service**: Automatically detects Azure OpenAI configuration - **Authentication**: Ready for Microsoft Entra ID integration - **CORS**: Configurable allowed origins @@ -180,7 +180,7 @@ The application uses environment-based configuration with sensible defaults: - CORS configuration - Input validation with Pydantic -- SQL injection prevention (Cosmos DB) +- SQL injection prevention (Azure Cosmos DB) - Rate limiting ready (can be added) - Authentication ready (Microsoft Entra ID) @@ -205,7 +205,7 @@ The application uses environment-based configuration with sensible defaults: 1. Update models in `app/models.py` 2. Update database service in `app/database.py` -3. Update Cosmos DB service in `app/cosmos_service.py` +3. Update Azure Cosmos DB service in `app/cosmos_service.py` 4. Add migration scripts if needed ## Deployment diff --git a/scenario-app/backend/app/agent_instructions.py b/scenario-app/backend/app/agent_instructions.py index 9cb21f30..72794111 100644 --- a/scenario-app/backend/app/agent_instructions.py +++ b/scenario-app/backend/app/agent_instructions.py @@ -74,7 +74,7 @@ - Be overly salesy or pushy Available Tools: -- search(query, limit) - Search products with hybrid AI Search + Cosmos DB +- search(query, limit) - Search products with hybrid Azure AI Search + Azure Cosmos DB - search_fast(query, limit) - Ultra-fast product search for quick responses - get_by_id(product_id) - Get specific product by ID - get_by_category(category, limit) - Get products in a specific category @@ -163,7 +163,7 @@ - Provide wrong contact information Available Tools: -- lookup(query, top) - Search policy documents with enhanced AI Search +- lookup(query, top) - Search policy documents with enhanced Azure AI Search - lookup_policy(query, context) - Context-aware policy lookup - get_return_policy() - Get return policy information - get_shipping_info() - Get shipping information diff --git a/scenario-app/backend/app/config.py b/scenario-app/backend/app/config.py index 0b67c2cf..7b4fb600 100644 --- a/scenario-app/backend/app/config.py +++ b/scenario-app/backend/app/config.py @@ -82,7 +82,7 @@ class Config: settings = Settings() -# Check if we have Cosmos DB configuration +# Check if we have Azure Cosmos DB configuration def has_cosmos_db_config() -> bool: v = settings.cosmos_db_endpoint return v is not None and str(v).strip() != "" diff --git a/scenario-app/backend/app/cosmos_service.py b/scenario-app/backend/app/cosmos_service.py index ad08dc9b..e9a1b1a4 100644 --- a/scenario-app/backend/app/cosmos_service.py +++ b/scenario-app/backend/app/cosmos_service.py @@ -64,7 +64,7 @@ def _prepare_query_parameters(params: List[Dict[str, Any]]) -> List[Dict[str, ob class CosmosDatabaseService: - """Cosmos DB implementation of the database service""" + """Azure Cosmos DB implementation of the database service""" def __init__(self): # Type annotations for instance variables @@ -76,14 +76,14 @@ def __init__(self): self.cart_container: ContainerProxy self.transactions_container: ContainerProxy - # Use Azure credential authentication for AAD-enabled Cosmos DB + # Use Azure credential authentication for AAD-enabled Azure Cosmos DB try: # Ensure we have the endpoint if not settings.cosmos_db_endpoint: - raise Exception("Cosmos DB endpoint is required") + raise Exception("Azure Cosmos DB endpoint is required") logger.info( - "Attempting to authenticate to Cosmos DB with Azure credentials..." + "Attempting to authenticate to Azure Cosmos DB with Azure credentials..." ) # Use the centralized credential utility that handles dev vs prod environments @@ -106,11 +106,11 @@ def __init__(self): if "RBAC permissions" in error_msg or "principal" in error_msg: raise Exception( f""" -❌ RBAC Permission Error: Your service principal lacks Cosmos DB permissions. +❌ RBAC Permission Error: Your service principal lacks Azure Cosmos DB permissions. To fix this, run these Azure CLI commands: -1. Assign Cosmos DB Data Contributor role: +1. Assign Azure Cosmos DB Data Contributor role: az cosmosdb sql role assignment create \\ --account-name ecommerce-prod-cosmos-202510211322 \\ --resource-group [YOUR_RESOURCE_GROUP] \\ @@ -132,11 +132,11 @@ def __init__(self): if "Local Authorization is disabled" in error_msg: raise Exception( f""" -❌ Authentication Error: This Cosmos DB requires AAD authentication and your credentials don't have proper permissions. +❌ Authentication Error: This Azure Cosmos DB requires AAD authentication and your credentials don't have proper permissions. Solutions: 1. Grant RBAC permissions (see commands above) -2. Ask your Azure admin to assign "Cosmos DB Built-in Data Contributor" role +2. Ask your Microsoft Entra ID admin to assign "Cosmos DB Built-in Data Contributor" role 3. Or temporarily enable local auth: az cosmosdb update --name ecommerce-prod-cosmos-202510211322 --resource-group [RESOURCE_GROUP] --disable-key-based-metadata-write-access false Original error: {error_msg} @@ -145,7 +145,7 @@ def __init__(self): # Generic authentication error raise Exception( - f"Cannot authenticate to Cosmos DB with Azure credentials. Check your Azure login and permissions. Error: {error_msg}" + f"Cannot authenticate to Azure Cosmos DB with Azure credentials. Check your Azure login and permissions. Error: {error_msg}" ) self.database = self.client.get_database_client( @@ -154,7 +154,7 @@ def __init__(self): self._initialize_containers() def _serialize_datetime_fields(self, data: dict) -> dict: - """Convert datetime objects to ISO format for Cosmos DB serialization""" + """Convert datetime objects to ISO format for Azure Cosmos DB serialization""" serialized_data = data.copy() for key, value in serialized_data.items(): if isinstance(value, datetime): @@ -180,7 +180,7 @@ def _deserialize_datetime_fields(self, data: dict) -> dict: return deserialized_data def _initialize_containers(self): - """Initialize Cosmos DB containers""" + """Initialize Azure Cosmos DB containers""" try: # Create database if it doesn't exist self.database = self.client.create_database_if_not_exists( @@ -218,10 +218,10 @@ def _initialize_containers(self): offer_throughput=400, ) - logger.info("Cosmos DB containers initialized successfully") + logger.info("Azure Cosmos DB containers initialized successfully") except Exception as e: - logger.error(f"Error initializing Cosmos DB containers: {str(e)}") + logger.error(f"Error initializing Azure Cosmos DB containers: {str(e)}") raise async def get_products( @@ -322,11 +322,11 @@ async def get_products( return products except Exception as e: - logger.error(f"Error fetching products from Cosmos DB: {str(e)}") + logger.error(f"Error fetching products from Azure Cosmos DB: {str(e)}") raise async def get_product(self, product_id: str) -> Optional[Product]: - """Get a single product by ID - optimized for Cosmos DB""" + """Get a single product by ID - optimized for Azure Cosmos DB""" try: # Use direct read for better performance (if we know the partition key) # For now, use cross-partition query since products might be in different partitions @@ -350,7 +350,7 @@ async def get_product(self, product_id: str) -> Optional[Product]: item[field].replace("Z", "+00:00") ) - # Map Cosmos DB fields to Product model fields + # Map Azure Cosmos DB fields to Product model fields product = Product( id=item.get("id"), title=item.get("title", ""), @@ -371,7 +371,7 @@ async def get_product(self, product_id: str) -> Optional[Product]: return None except Exception as e: - logger.error(f"Error fetching product from Cosmos DB: {str(e)}") + logger.error(f"Error fetching product from Azure Cosmos DB: {str(e)}") raise async def create_product(self, product: ProductCreate) -> Product: @@ -379,13 +379,13 @@ async def create_product(self, product: ProductCreate) -> Product: try: new_product = Product(id=str(uuid.uuid4()), **product.model_dump()) - # Serialize datetime fields for Cosmos DB + # Serialize datetime fields for Azure Cosmos DB product_dict = self._serialize_datetime_fields(new_product.model_dump()) self.products_container.create_item(product_dict) # type: ignore return new_product except Exception as e: - logger.error(f"Error creating product in Cosmos DB: {str(e)}") + logger.error(f"Error creating product in Azure Cosmos DB: {str(e)}") raise async def update_product( @@ -405,7 +405,7 @@ async def update_product( existing_product.updated_at = datetime.utcnow() - # Replace in Cosmos DB - serialize datetime fields + # Replace in Azure Cosmos DB - serialize datetime fields product_dict = self._serialize_datetime_fields( existing_product.model_dump() ) @@ -416,7 +416,7 @@ async def update_product( return existing_product except Exception as e: - logger.error(f"Error updating product in Cosmos DB: {str(e)}") + logger.error(f"Error updating product in Azure Cosmos DB: {str(e)}") raise async def delete_product(self, product_id: str) -> bool: @@ -435,7 +435,7 @@ async def delete_product(self, product_id: str) -> bool: return True except Exception as e: - logger.error(f"Error deleting product from Cosmos DB: {str(e)}") + logger.error(f"Error deleting product from Azure Cosmos DB: {str(e)}") raise async def get_product_by_sku(self, sku: str) -> Optional[Product]: @@ -486,7 +486,7 @@ async def search_products(self, query: str, limit: int = 10) -> List[Product]: async def search_products_hybrid( self, query: str, limit: int = 10 ) -> List[Product]: - """Hybrid search: Azure AI Search first (fast), then Cosmos DB fallback""" + """Hybrid search: Azure AI Search first (fast), then Azure Cosmos DB fallback""" try: # Strategy 1: Try Azure AI Search first (fastest, most accurate) try: @@ -499,16 +499,16 @@ async def search_products_hybrid( f"Azure AI Search returned {len(ai_search_results)} products for query: {query}" ) - # Convert AI Search results to Product objects + # Convert Azure AI Search results to Product objects products = [] for hit in ai_search_results: - # Try to get full product data from Cosmos DB + # Try to get full product data from Azure Cosmos DB try: full_product = await self.get_product_by_sku(hit["id"]) if full_product: products.append(full_product) else: - # Create Product from AI Search data + # Create Product from Azure AI Search data product = Product( id=hit["id"], title=hit.get("title", ""), @@ -532,21 +532,21 @@ async def search_products_hybrid( if products: logger.info( - f"Hybrid search (AI Search) returned {len(products)} products" + f"Hybrid search (Azure AI Search) returned {len(products)} products" ) return products[:limit] except ImportError: logger.warning( - "Azure AI Search not available, falling back to Cosmos DB" + "Azure AI Search not available, falling back to Azure Cosmos DB" ) except Exception as e: logger.warning( - f"Azure AI Search failed: {e}, falling back to Cosmos DB" + f"Azure AI Search failed: {e}, falling back to Azure Cosmos DB" ) - # Strategy 2: Fallback to enhanced Cosmos DB search - logger.info(f"Falling back to enhanced Cosmos DB search for query: {query}") + # Strategy 2: Fallback to enhanced Azure Cosmos DB search + logger.info(f"Falling back to enhanced Azure Cosmos DB search for query: {query}") return await self.search_products_enhanced(query, limit) except Exception as e: @@ -566,16 +566,16 @@ async def search_products_ai_search( if not ai_search_results: return [] - # Convert AI Search results to Product objects + # Convert Azure AI Search results to Product objects products = [] for hit in ai_search_results: try: - # Try to get full product data from Cosmos DB + # Try to get full product data from Azure Cosmos DB full_product = await self.get_product_by_sku(hit["id"]) if full_product: products.append(full_product) else: - # Create Product from AI Search data + # Create Product from Azure AI Search data product = Product( id=hit["id"], title=hit.get("title", ""), @@ -593,17 +593,17 @@ async def search_products_ai_search( products.append(product) except Exception as e: logger.warning( - f"Failed to process AI Search result {hit['id']}: {e}" + f"Failed to process Azure AI Search result {hit['id']}: {e}" ) continue logger.info( - f"AI Search returned {len(products)} products for query: {query}" + f"Azure AI Search returned {len(products)} products for query: {query}" ) return products[:limit] except Exception as e: - logger.error(f"AI Search error: {e}") + logger.error(f"Azure AI Search error: {e}") return [] async def search_products_enhanced( @@ -876,14 +876,14 @@ async def create_user(self, user: UserCreate) -> User: try: new_user = User(id=str(uuid.uuid4()), email=user.email, name=user.name) - # Convert datetime objects to ISO format for Cosmos DB + # Convert datetime objects to ISO format for Azure Cosmos DB user_dict = self._serialize_datetime_fields(new_user.model_dump()) self.users_container.create_item(user_dict) # type: ignore return new_user except Exception as e: - logger.error(f"Error creating user in Cosmos DB: {str(e)}") + logger.error(f"Error creating user in Azure Cosmos DB: {str(e)}") raise async def get_user_by_id(self, user_id: str) -> Optional[User]: @@ -922,7 +922,7 @@ async def get_user_by_id(self, user_id: str) -> Optional[User]: raise async def get_user_by_email(self, email: str) -> Optional[User]: - """Get user by email - optimized for Cosmos DB""" + """Get user by email - optimized for Azure Cosmos DB""" try: # Use a simple, efficient query query = "SELECT * FROM c WHERE c.email = @email" @@ -958,7 +958,7 @@ async def get_user_by_email(self, email: str) -> Optional[User]: async def create_user_with_password( self, email: str, name: str, password: str, user_id: Optional[str] = None ) -> User: - """Create a new user - simplified for Cosmos DB""" + """Create a new user - simplified for Azure Cosmos DB""" try: # Use provided user_id (from Easy Auth) or generate UUID new_user = User(id=user_id or str(uuid.uuid4()), email=email, name=name) @@ -973,7 +973,7 @@ async def create_user_with_password( else: user_dict[field] = dt.isoformat() - # Create in Cosmos DB using user ID as partition key + # Create in Azure Cosmos DB using user ID as partition key self.users_container.create_item(user_dict) # type: ignore return new_user @@ -982,7 +982,7 @@ async def create_user_with_password( raise async def update_user(self, user_id: str, user: UserUpdate) -> Optional[User]: - """Update user - simplified for Cosmos DB""" + """Update user - simplified for Azure Cosmos DB""" try: # Get existing user existing_user = await self.get_user(user_id) @@ -1006,7 +1006,7 @@ async def update_user(self, user_id: str, user: UserUpdate) -> Optional[User]: else: user_dict[field] = dt.isoformat() - # Replace in Cosmos DB + # Replace in Azure Cosmos DB self.users_container.replace_item( # type: ignore item=user_id, body=user_dict ) @@ -1061,7 +1061,7 @@ async def get_chat_session( return ChatSession(**session_data) except Exception as e: - logger.error(f"Error fetching chat session from Cosmos DB: {str(e)}") + logger.error(f"Error fetching chat session from Azure Cosmos DB: {str(e)}") raise async def get_chat_sessions_by_user(self, user_id: str) -> List[ChatSession]: @@ -1101,7 +1101,7 @@ async def get_chat_sessions_by_user(self, user_id: str) -> List[ChatSession]: return sessions except Exception as e: - logger.error(f"Error fetching chat sessions from Cosmos DB: {str(e)}") + logger.error(f"Error fetching chat sessions from Azure Cosmos DB: {str(e)}") raise async def create_chat_session(self, session: ChatSessionCreate) -> ChatSession: @@ -1135,7 +1135,7 @@ async def create_chat_session(self, session: ChatSessionCreate) -> ChatSession: return new_session except Exception as e: - logger.error(f"Error creating chat session in Cosmos DB: {str(e)}") + logger.error(f"Error creating chat session in Azure Cosmos DB: {str(e)}") raise async def add_message_to_session( @@ -1213,7 +1213,7 @@ async def add_message_to_session( if "created_at" in msg and isinstance(msg["created_at"], datetime): msg["created_at"] = msg["created_at"].isoformat() - # Update session in Cosmos DB + # Update session in Azure Cosmos DB self.chat_container.upsert_item(session_dict) # type: ignore # Return the updated session (re-fetch to ensure consistency) @@ -1223,7 +1223,7 @@ async def add_message_to_session( return updated_session except Exception as e: - logger.error(f"Error adding message to chat session in Cosmos DB: {str(e)}") + logger.error(f"Error adding message to chat session in Azure Cosmos DB: {str(e)}") raise async def update_chat_session( @@ -1259,13 +1259,13 @@ async def update_chat_session( if "created_at" in msg and isinstance(msg["created_at"], datetime): msg["created_at"] = msg["created_at"].isoformat() - # Update in Cosmos DB + # Update in Azure Cosmos DB self.chat_container.upsert_item(session_dict) # type: ignore return session except Exception as e: - logger.error(f"Error updating chat session in Cosmos DB: {str(e)}") + logger.error(f"Error updating chat session in Azure Cosmos DB: {str(e)}") raise async def delete_chat_session( @@ -1289,7 +1289,7 @@ async def delete_chat_session( return True except Exception as e: - logger.error(f"Error deleting chat session from Cosmos DB: {str(e)}") + logger.error(f"Error deleting chat session from Azure Cosmos DB: {str(e)}") raise async def get_cart(self, user_id: str) -> Optional[Cart]: @@ -1329,11 +1329,11 @@ async def get_cart(self, user_id: str) -> Optional[Cart]: return Cart(**cart_data) except Exception as e: - logger.error(f"Error fetching cart from Cosmos DB: {str(e)}") + logger.error(f"Error fetching cart from Azure Cosmos DB: {str(e)}") raise async def update_cart(self, user_id: str, cart: Cart) -> Cart: - """Update user's cart - optimized for Cosmos DB""" + """Update user's cart - optimized for Azure Cosmos DB""" try: # Set the cart ID to user_id for direct access cart.id = user_id @@ -1364,7 +1364,7 @@ async def update_cart(self, user_id: str, cart: Cart) -> Cart: return cart except Exception as e: - logger.error(f"Error updating cart in Cosmos DB: {str(e)}") + logger.error(f"Error updating cart in Azure Cosmos DB: {str(e)}") raise async def create_transaction( @@ -1394,7 +1394,7 @@ async def create_transaction( + new_transaction.shipping ) - # Serialize datetime fields for Cosmos DB + # Serialize datetime fields for Azure Cosmos DB transaction_dict = self._serialize_datetime_fields( new_transaction.model_dump() ) @@ -1403,7 +1403,7 @@ async def create_transaction( return new_transaction except Exception as e: - logger.error(f"Error creating transaction in Cosmos DB: {str(e)}") + logger.error(f"Error creating transaction in Azure Cosmos DB: {str(e)}") raise # Additional methods required by DatabaseService interface diff --git a/scenario-app/backend/app/create_assistants.py b/scenario-app/backend/app/create_assistants.py index 55606964..e1ef648f 100644 --- a/scenario-app/backend/app/create_assistants.py +++ b/scenario-app/backend/app/create_assistants.py @@ -21,8 +21,8 @@ async def create_assistants(): await init_foundry_client() client = get_foundry_client() - # Get OpenAI client - print("Getting OpenAI client...") + # Get Azure OpenAI client + print("Getting Azure OpenAI client...") openai_client = await client.get_openai_client( # type: ignore api_version=settings.azure_openai_api_version ) diff --git a/scenario-app/backend/app/database.py b/scenario-app/backend/app/database.py index 07a17bb7..25377739 100644 --- a/scenario-app/backend/app/database.py +++ b/scenario-app/backend/app/database.py @@ -145,7 +145,7 @@ def get_database_service() -> EcommerceDatabaseService: return EcommerceMemoryService() else: - print("No Cosmos DB configuration found, using in-memory service") + print("No Azure Cosmos DB configuration found, using in-memory service") from .memory_service import EcommerceMemoryService return EcommerceMemoryService() diff --git a/scenario-app/backend/app/list_assistants.py b/scenario-app/backend/app/list_assistants.py index a7b62fcc..b7e83440 100644 --- a/scenario-app/backend/app/list_assistants.py +++ b/scenario-app/backend/app/list_assistants.py @@ -20,8 +20,8 @@ async def list_assistants(): await init_foundry_client() client = get_foundry_client() - # Get OpenAI client - print("Getting OpenAI client...") + # Get Azure OpenAI client + print("Getting Azure OpenAI client...") from config import settings openai_client = await client.get_openai_client( # type: ignore diff --git a/scenario-app/backend/app/plugins/orders_plugin.py b/scenario-app/backend/app/plugins/orders_plugin.py index dc563412..02006d51 100644 --- a/scenario-app/backend/app/plugins/orders_plugin.py +++ b/scenario-app/backend/app/plugins/orders_plugin.py @@ -24,7 +24,7 @@ def run_async_sync(coro): class OrdersPlugin: - """Plugin for order management using Cosmos DB""" + """Plugin for order management using Azure Cosmos DB""" @kernel_function(description="Get order by ID and return JSON") def get_order(self, order_id: str) -> str: diff --git a/scenario-app/backend/app/plugins/product_plugin.py b/scenario-app/backend/app/plugins/product_plugin.py index ff150c2b..82d42fe2 100644 --- a/scenario-app/backend/app/plugins/product_plugin.py +++ b/scenario-app/backend/app/plugins/product_plugin.py @@ -26,7 +26,7 @@ def run_async_sync(coro): class ProductPlugin: - """Enhanced plugin for product search and lookup using Cosmos DB""" + """Enhanced plugin for product search and lookup using Azure Cosmos DB""" @kernel_function( description="Lookup a product by ID and return natural language description" @@ -62,10 +62,10 @@ def get_by_id(self, product_id: str) -> str: return "I'm having trouble looking up that product right now. Please try again or contact support." @kernel_function( - description="Search products with hybrid AI Search + Cosmos DB for maximum speed and accuracy" + description="Search products with hybrid Azure AI Search + Azure Cosmos DB for maximum speed and accuracy" ) def search(self, query: str, limit: int = 5) -> str: - """Hybrid product search with AI Search first, then Cosmos DB fallback""" + """Hybrid product search with Azure AI Search first, then Azure Cosmos DB fallback""" try: cosmos_service = get_cosmos_service() @@ -79,7 +79,7 @@ def search(self, query: str, limit: int = 5) -> str: suggestions = self._get_search_suggestions(query) return f"I couldn't find any products matching '{query}'. {suggestions}" - # Format response naturally with AI Search insights + # Format response naturally with Azure AI Search insights response_parts = [] if len(products) == 1: @@ -136,11 +136,11 @@ def search(self, query: str, limit: int = 5) -> str: @kernel_function(description="Fast product search optimized for chat responses") def search_fast(self, query: str, limit: int = 3) -> str: - """Ultra-fast product search using AI Search only""" + """Ultra-fast product search using Azure AI Search only""" try: cosmos_service = get_cosmos_service() - # Use AI Search only for maximum speed + # Use Azure AI Search only for maximum speed products = run_async_sync( cosmos_service.search_products_ai_search(query, limit) ) diff --git a/scenario-app/backend/app/routers/chat.py b/scenario-app/backend/app/routers/chat.py index dbfb274f..2a91a344 100644 --- a/scenario-app/backend/app/routers/chat.py +++ b/scenario-app/backend/app/routers/chat.py @@ -291,7 +291,7 @@ async def save_voice_message( message: ChatMessageCreate, current_user: Optional[Dict[str, Any]] = Depends(get_current_user_optional), ): - """Save a voice message to Cosmos DB without triggering Foundry agents.""" + """Save a voice message to Azure Cosmos DB without triggering Foundry agents.""" try: user_id = current_user.get("user_id") if current_user else None session_id = getattr(message, "session_id", None) @@ -433,7 +433,7 @@ async def send_message_legacy( else: raise HTTPException(status_code=500, detail="AI agent returned no response") - # Save AI response to Cosmos DB + # Save AI response to Azure Cosmos DB ai_response = ChatMessageCreate( content=response_content, message_type=ChatMessageType.ASSISTANT, diff --git a/scenario-app/backend/app/simple_foundry_orchestrator.py b/scenario-app/backend/app/simple_foundry_orchestrator.py index d158d28c..632c3433 100644 --- a/scenario-app/backend/app/simple_foundry_orchestrator.py +++ b/scenario-app/backend/app/simple_foundry_orchestrator.py @@ -87,7 +87,7 @@ async def _build_foundry_agent( client = get_foundry_client() try: - # Get the OpenAI client from Foundry with proper API version + # Get the Azure OpenAI client from Foundry with proper API version openai_client = await client.get_openai_client( # type: ignore api_version=settings.azure_openai_api_version ) @@ -98,7 +98,7 @@ async def _build_foundry_agent( f"βœ… Successfully connected to Foundry assistant: {assistant.name or name}" ) - # Create a custom agent that uses the OpenAI client directly + # Create a custom agent that uses the Azure OpenAI client directly class FoundryAgent: def __init__(self, assistant_id: str, name: str, openai_client): self.id = assistant_id diff --git a/scenario-app/backend/app/utils/voice_utils.py b/scenario-app/backend/app/utils/voice_utils.py index 196d68db..f5e471c1 100644 --- a/scenario-app/backend/app/utils/voice_utils.py +++ b/scenario-app/backend/app/utils/voice_utils.py @@ -9,7 +9,7 @@ from .azure_credential_utils import get_azure_credential_async -# OpenAI realtime voice names (passed as plain strings, not AzureStandardVoice) +# Azure OpenAI realtime voice names (passed as plain strings, not AzureStandardVoice) REALTIME_VOICES = frozenset({ "alloy", "ash", "ballad", "coral", "echo", "sage", "shimmer", "verse", }) diff --git a/scenario-app/frontend/LOCAL_AUTH_SETUP.md b/scenario-app/frontend/LOCAL_AUTH_SETUP.md index 25d5b6e4..de5861da 100644 --- a/scenario-app/frontend/LOCAL_AUTH_SETUP.md +++ b/scenario-app/frontend/LOCAL_AUTH_SETUP.md @@ -39,7 +39,7 @@ AZURE_CLIENT_SECRET=your-client-secret ### 3. Azure App Registration 1. Go to [Azure Portal](https://portal.azure.com) -2. Navigate to "Azure Active Directory" > "App registrations" +2. Navigate to "Microsoft Entra ID" > "App registrations" 3. Click "New registration" 4. Fill in: - Name: "E-commerce Chat Local Dev" diff --git a/scenario-app/frontend/src/lib/api.ts b/scenario-app/frontend/src/lib/api.ts index 8c159b44..eb6189ea 100644 --- a/scenario-app/frontend/src/lib/api.ts +++ b/scenario-app/frontend/src/lib/api.ts @@ -339,7 +339,7 @@ export const getVoiceLiveConfig = async (): Promise => { return response.data as VoiceLiveConfig; }; -/** Save a voice message to the chat session (Cosmos DB) without triggering Foundry agents. */ +/** Save a voice message to the chat session (Azure Cosmos DB) without triggering Foundry agents. */ export const saveVoiceMessage = async ( sessionId: string, content: string,