From ca826cd0bc5d36b0c20dab449009f4a6595e1843 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Sat, 18 Apr 2026 16:11:30 +0530
Subject: [PATCH 01/28] RakeshRamini changes to contentflow v0.1.2

---
 azure.yaml                                    | 32 ++++-----
 contentflow-api/app/settings.py               |  5 +-
 contentflow-worker/main.py                    | 16 +++--
 infra/bicep/main.bicep                        | 66 ++++++++++++-------
 infra/bicep/main.parameters.json              |  3 +
 infra/bicep/modules/app-config-store.bicep    | 20 +++---
 infra/bicep/modules/cae-dns-zone.bicep        | 64 ++++++++++++++++++
 infra/bicep/modules/container-app.bicep       | 18 +++--
 .../modules/container-apps-environment.bicep  | 16 ++---
 infra/bicep/modules/container-registry.bicep  | 22 +++----
 infra/bicep/modules/cosmos.bicep              | 20 +++---
 infra/bicep/modules/storage.bicep             | 40 +++++------
 infra/scripts/ailz-resources.env              | 18 +++++
 infra/scripts/post-deploy.sh                  | 65 ++++++++++++++++++
 infra/scripts/pre-provision.sh                |  6 ++
 15 files changed, 295 insertions(+), 116 deletions(-)
 create mode 100644 infra/bicep/modules/cae-dns-zone.bicep
 create mode 100644 infra/scripts/ailz-resources.env

diff --git a/azure.yaml b/azure.yaml
index 6f82a38..1f7e5aa 100644
--- a/azure.yaml
+++ b/azure.yaml
@@ -22,7 +22,7 @@ services:
       path: ./Dockerfile
       context: ..
       target: ""
-      remoteBuild: true
+      remoteBuild: false
 
   # ContentFlow Worker - Container App
   worker:
@@ -33,7 +33,7 @@ services:
       path: ./Dockerfile
       context: ..
       target: ""
-      remoteBuild: true
+      remoteBuild: false
 
   # ContentFlow Web - Container App
   web:
@@ -44,16 +44,16 @@ services:
       path: ./Dockerfile
       context: ..
       target: ""
-      remoteBuild: true
+      remoteBuild: false
     
 # Global hooks
-# hooks:
-#   # Run before provisioning infrastructure
-#   preprovision:
-#     shell: sh
-#     run: ./infra/scripts/pre-provision.sh
-#     interactive: false
-#     continueOnError: false
+hooks:
+  # Import placeholder image to ACR before provisioning (needed for AILZ internal environments)
+  preprovision:
+    shell: sh
+    run: ./infra/scripts/pre-provision.sh
+    interactive: false
+    continueOnError: false
   
 #   # Run after infrastructure is provisioned
 #   # postprovision:
@@ -69,9 +69,9 @@ services:
 #   #   interactive: false
 #   #   continueOnError: false
 
-#   # Run after all services are deployed
-#   postdeploy:
-#     shell: sh
-#     run: ./infra/scripts/post-deploy.sh
-#     interactive: true
-#     continueOnError: false
+  # Run after all services are deployed
+  postdeploy:
+    shell: sh
+    run: ./infra/scripts/post-deploy.sh
+    interactive: true
+    continueOnError: false
diff --git a/contentflow-api/app/settings.py b/contentflow-api/app/settings.py
index 3f6e8f2..3789f55 100644
--- a/contentflow-api/app/settings.py
+++ b/contentflow-api/app/settings.py
@@ -67,7 +67,10 @@ class AppSettings(BaseModel):
     def __init__(self, **kwargs):
         """Initialize AppSettings and load configuration from Azure App Configuration"""
         super().__init__(**kwargs)
-        self._load_from_app_config()
+        try:
+            self._load_from_app_config()
+        except Exception as e:
+            print(f"\033[93m⚠️ Could not load from App Config: {e}. Using defaults/env vars.\033[0m")
 
     def _load_from_app_config(self):
         """Load configuration values from Azure App Configuration"""
diff --git a/contentflow-worker/main.py b/contentflow-worker/main.py
index 12caf23..80a86d5 100644
--- a/contentflow-worker/main.py
+++ b/contentflow-worker/main.py
@@ -51,13 +51,19 @@ def main(settings: WorkerSettings):
         print(f"API Enabled: http://{settings.API_HOST}:{settings.API_PORT}")
     print("=" * 60)
     
-    # Run startup checks
+    # Run startup checks with retries (Azure services may need time for DNS/RBAC propagation)
+    import time
+    max_startup_retries = 5
     print("Running startup validation checks...")
-    if not run_startup_checks(settings):
-        print("\033[91m❌ Startup validation failed. Exiting.\033[0m")
-        sys.exit(1)
+    for _attempt in range(max_startup_retries):
+        if run_startup_checks(settings):
+            print("✅ Startup validation passed.")
+            break
+        wait = min(30, 5 * (_attempt + 1))
+        print(f"⏳ Startup check failed (attempt {_attempt + 1}/{max_startup_retries}), retrying in {wait}s...")
+        time.sleep(wait)
     else:
-        print("✅ Startup validation passed.")
+        print("\033[93m⚠️ Startup validation did not pass after retries, continuing with available config...\033[0m")
     
     # Create worker engine
     print("Creating worker engine...")
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index 47af02c..6fcb670 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -42,6 +42,9 @@ param existingCognitiveServicesPrivateDnsZoneId string = ''
 @description('Resource ID of existing Blob Storage Private DNS Zone (required for ailz-integrated mode)')
 param existingBlobPrivateDnsZoneId string = ''
 
+@description('Resource ID of existing Queue Storage Private DNS Zone (optional for ailz-integrated mode)')
+param existingQueuePrivateDnsZoneId string = ''
+
 @description('Resource ID of existing Cosmos DB Private DNS Zone (required for ailz-integrated mode)')
 param existingCosmosPrivateDnsZoneId string = ''
 
@@ -130,6 +133,7 @@ var networkConfig = isAILZIntegrated ? {
   privateDnsZoneIds: {
     cognitiveServices: existingCognitiveServicesPrivateDnsZoneId
     blob: existingBlobPrivateDnsZoneId
+    queue: existingQueuePrivateDnsZoneId
     cosmos: existingCosmosPrivateDnsZoneId
     appConfig: existingAppConfigPrivateDnsZoneId
     acr: existingAcrPrivateDnsZoneId
@@ -218,6 +222,7 @@ module storage 'modules/storage.bicep' = {
     enablePrivateEndpoint: isAILZIntegrated
     privateEndpointSubnetId: isAILZIntegrated ? networkConfig.privateEndpointSubnetId : ''
     blobPrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.blob : ''
+    queuePrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.queue : ''
     publicNetworkAccess: isAILZIntegrated ? 'Disabled' : 'Enabled'
     logAnalyticsWorkspaceId: logAnalyticsWorkspaceId
     tags: tags
@@ -259,7 +264,7 @@ module appConfigStore 'modules/app-config-store.bicep' = {
     enablePrivateEndpoint: isAILZIntegrated
     privateEndpointSubnetId: isAILZIntegrated ? networkConfig.privateEndpointSubnetId : ''
     appConfigPrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.appConfig : ''
-    publicNetworkAccess: isAILZIntegrated ? 'Disabled' : 'Enabled'
+    publicNetworkAccess: 'Enabled' // Must be Enabled during provisioning for ARM to write key-values via data-plane proxy
     tags: tags
   }
 }
@@ -341,11 +346,7 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         name: 'contentflow.api.CORS_ALLOW_ORIGINS'
         value: '*'
       }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.api.WORKER_ENGINE_API_ENDPOINT'
-        value: 'https://${workerContainerApp.outputs.fqdn}'
-      }
+      // NOTE: WORKER_ENGINE_API_ENDPOINT moved to apiContainerApp env vars to break circular dependency
       // Worker settings
       {
         contentType: 'text/plain'
@@ -430,7 +431,7 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
     ]
   }
   dependsOn: [
-    // appConfigStore
+    appConfigStore
   ]
 }
 
@@ -445,7 +446,7 @@ module containerRegistry 'modules/container-registry.bicep' = {
     location: location
     roleAssignedManagedIdentityPrincipalIds: [userAssignedIdentity.outputs.principalId]
     enablePrivateEndpoint: isAILZIntegrated
-    privateEndpointSubnetId: isAILZIntegrated ? networkConfig.privateEndpointsSubnetId : ''
+    privateEndpointSubnetId: isAILZIntegrated ? networkConfig.privateEndpointSubnetId : ''
     acrPrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.acr : ''
     publicNetworkAccess: isAILZIntegrated ? 'Disabled' : 'Enabled'
     tags: tags
@@ -456,17 +457,17 @@ module containerRegistry 'modules/container-registry.bicep' = {
 // Create new Container Apps Environment, with private endpoint support (if using AILZ integrated mode),
 // or use public endpoints (basic mode)
 
+// Pass resolved Log Analytics workspace resource ID to the module (it derives customerId/sharedKey internally)
+
 module containerAppsEnvironment 'modules/container-apps-environment.bicep' = {
   name: 'cae-la-${resourceToken}'
   params: {
     containerAppsEnvironmentName: containerAppsEnvironmentName
-    logAnalyticsWorkspaceId: !empty(existingLogAnalyticsWorkspaceId) ? existingLogAnalyticsWorkspaceId : logAnalytics!.outputs.logAnalyticsWorkspaceId
-    logAnalyticsPrimarySharedKey: !empty(existingLogAnalyticsWorkspaceId) ? listKeys(existingLogAnalyticsWorkspaceId, '2021-12-01-preview').primarySharedKey : logAnalytics.outputs.primarySharedKey
+    logAnalyticsWorkspaceResourceId: logAnalyticsWorkspaceId
     userAssignedResourceIds: [userAssignedIdentity.outputs.resourceId]
     location: location
     enablePrivateEndpoint: isAILZIntegrated
     privateEndpointSubnetId: isAILZIntegrated ? networkConfig.containerAppsSubnetId : null
-    // caePrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.existingContainerAppsEnvPrivateDnsZoneId : ''
     publicNetworkAccess: isAILZIntegrated ? 'Disabled' : 'Enabled'
     tags: tags
   }
@@ -483,22 +484,35 @@ module aiFoundry 'modules/ai-foundry.bicep' = {
   }
 }
 
+// ========== CAE PRIVATE DNS ZONE (AILZ mode only) ==========
+// Internal CAE requires a private DNS zone matching its default domain
+// with a wildcard A record pointing to its static IP for DNS resolution
+module caeDnsZone 'modules/cae-dns-zone.bicep' = if (isAILZIntegrated) {
+  name: 'cae-dns-${resourceToken}'
+  params: {
+    caeDefaultDomain: containerAppsEnvironment.outputs.defaultDomain
+    caeStaticIp: containerAppsEnvironment.outputs.staticIp
+    vnetResourceId: existingVnetResourceId
+    tags: tags
+  }
+}
+
 // ========== API CONTAINER APP ==========
 module apiContainerApp 'modules/container-app.bicep' = {
   name: 'ca-api-${resourceToken}'
   params: {
     name: apiContainerAppName
-    location: containerAppsEnvironment!.outputs.location
-    containerAppsEnvId: containerAppsEnvironment!.outputs.resourceId
+    location: containerAppsEnvironment.outputs.location
+    containerAppsEnvId: containerAppsEnvironment.outputs.resourceId
     containerRegistryServer: containerRegistry!.outputs.loginServer
     managedIdentityId: userAssignedIdentity.outputs.resourceId
     targetPort: 8090
     externalIngress: !isAILZIntegrated
     corsEnabled: true
-    livenessProbePath: '/'
+    livenessProbePath: '' // Disabled for initial provisioning with placeholder image
     cpuCores: 2
     memoryInGB: '4Gi'
-    minReplicas: 1
+    minReplicas: 0 // Set to 0 for initial provisioning - container will scale up when real image is deployed
     maxReplicas: 2
     environmentVariables: [
       {
@@ -513,6 +527,10 @@ module apiContainerApp 'modules/container-app.bicep' = {
         name: 'AZURE_CLIENT_ID'
         value: userAssignedIdentity.outputs.clientId
       }
+      {
+        name: 'WORKER_ENGINE_API_ENDPOINT'
+        value: 'https://${workerContainerApp.outputs.fqdn}'
+      }
     ]
     tags: union(tags, { 'azd-service-name': 'api' })
   }
@@ -523,17 +541,17 @@ module workerContainerApp 'modules/container-app.bicep' = {
   name: 'ca-worker-${resourceToken}'
   params: {
     name: workerContainerAppName
-    location: containerAppsEnvironment!.outputs.location
-    containerAppsEnvId: containerAppsEnvironment!.outputs.resourceId
+    location: containerAppsEnvironment.outputs.location
+    containerAppsEnvId: containerAppsEnvironment.outputs.resourceId
     containerRegistryServer: containerRegistry!.outputs.loginServer
     managedIdentityId: userAssignedIdentity.outputs.resourceId
     targetPort: workerContainerAppTargetPort
     externalIngress: !isAILZIntegrated
     corsEnabled: true
-    livenessProbePath: '/'
+    livenessProbePath: '' // Disabled for initial provisioning with placeholder image
     cpuCores: 2
     memoryInGB: '4Gi'
-    minReplicas: 1
+    minReplicas: 0 // Set to 0 for initial provisioning - container will scale up when real image is deployed
     maxReplicas: 3
     environmentVariables: [
       {
@@ -553,22 +571,22 @@ module workerContainerApp 'modules/container-app.bicep' = {
   }
 }
 
-// ========== API CONTAINER APP ==========
+// ========== WEB CONTAINER APP ==========
 module webContainerApp 'modules/container-app.bicep' = {
   name: 'ca-web-${resourceToken}'
   params: {
     name: webContainerAppName
-    location: containerAppsEnvironment!.outputs.location
-    containerAppsEnvId: containerAppsEnvironment!.outputs.resourceId
+    location: containerAppsEnvironment.outputs.location
+    containerAppsEnvId: containerAppsEnvironment.outputs.resourceId
     containerRegistryServer: containerRegistry!.outputs.loginServer
     managedIdentityId: userAssignedIdentity.outputs.resourceId
     targetPort: 8080
     externalIngress: !isAILZIntegrated
     corsEnabled: true
-    livenessProbePath: '/'
+    livenessProbePath: '' // Disabled for initial provisioning with placeholder image
     cpuCores: 1
     memoryInGB: '2Gi'
-    minReplicas: 1
+    minReplicas: 0 // Set to 0 for initial provisioning - container will scale up when real image is deployed
     maxReplicas: 1
     environmentVariables: [
       {
diff --git a/infra/bicep/main.parameters.json b/infra/bicep/main.parameters.json
index 57ef45e..9f8479a 100644
--- a/infra/bicep/main.parameters.json
+++ b/infra/bicep/main.parameters.json
@@ -32,6 +32,9 @@
     "existingBlobPrivateDnsZoneId": {
       "value": "${EXISTING_BLOB_PRIVATE_DNS_ZONE_ID=}"
     },
+    "existingQueuePrivateDnsZoneId": {
+      "value": "${EXISTING_QUEUE_PRIVATE_DNS_ZONE_ID=}"
+    },
     "existingCosmosPrivateDnsZoneId": {
       "value": "${EXISTING_COSMOS_PRIVATE_DNS_ZONE_ID=}"
     },
diff --git a/infra/bicep/modules/app-config-store.bicep b/infra/bicep/modules/app-config-store.bicep
index 565e447..3e70aed 100644
--- a/infra/bicep/modules/app-config-store.bicep
+++ b/infra/bicep/modules/app-config-store.bicep
@@ -64,17 +64,15 @@ module appConfigStore 'br/public:avm/res/app-configuration/configuration-store:0
         resourceGroupResourceId: resourceGroup().id
         subnetResourceId: privateEndpointSubnetId
         privateLinkServiceConnectionName: '${appConfigStoreName}-app-config-plsc'
-        privateDnsZoneGroups: [
-          {
-            name: 'app-config-dns-zone-group'
-            privateDnsZoneGroupConfigs: !empty(appConfigPrivateDnsZoneId) ? [
-              {
-                name: 'app-config'
-                privateDnsZoneResourceId: appConfigPrivateDnsZoneId
-              }
-            ] : []
-          }
-        ]
+        privateDnsZoneGroup: !empty(appConfigPrivateDnsZoneId) ? {
+          name: 'app-config-dns-zone-group'
+          privateDnsZoneGroupConfigs: [
+            {
+              name: 'app-config'
+              privateDnsZoneResourceId: appConfigPrivateDnsZoneId
+            }
+          ]
+        } : null
       }
     ] : []
   }
diff --git a/infra/bicep/modules/cae-dns-zone.bicep b/infra/bicep/modules/cae-dns-zone.bicep
new file mode 100644
index 0000000..35a6ead
--- /dev/null
+++ b/infra/bicep/modules/cae-dns-zone.bicep
@@ -0,0 +1,64 @@
+@description('The default domain of the Container Apps Environment (e.g. ambitiousdesert-f1f7e820.eastus.azurecontainerapps.io)')
+param caeDefaultDomain string
+
+@description('The static IP of the Container Apps Environment')
+param caeStaticIp string
+
+@description('Resource ID of the VNet to link the DNS zone to')
+param vnetResourceId string
+
+@description('Tags for resources')
+param tags object = {}
+
+// Create a Private DNS Zone matching the CAE default domain
+// Internal CAE requires DNS resolution of *.defaultDomain → staticIp
+resource privateDnsZone 'Microsoft.Network/privateDnsZones@2024-06-01' = {
+  name: caeDefaultDomain
+  location: 'global'
+  tags: tags
+}
+
+// Wildcard A record so all container app FQDNs resolve to the CAE static IP
+resource wildcardRecord 'Microsoft.Network/privateDnsZones/A@2024-06-01' = {
+  parent: privateDnsZone
+  name: '*'
+  properties: {
+    ttl: 300
+    aRecords: [
+      {
+        ipv4Address: caeStaticIp
+      }
+    ]
+  }
+}
+
+// Also add an @ record for the apex domain
+resource apexRecord 'Microsoft.Network/privateDnsZones/A@2024-06-01' = {
+  parent: privateDnsZone
+  name: '@'
+  properties: {
+    ttl: 300
+    aRecords: [
+      {
+        ipv4Address: caeStaticIp
+      }
+    ]
+  }
+}
+
+// Link the DNS zone to the VNet so jumpbox and other VNet resources can resolve
+resource vnetLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = {
+  parent: privateDnsZone
+  name: '${last(split(vnetResourceId, '/'))}-cae-link'
+  location: 'global'
+  tags: tags
+  properties: {
+    virtualNetwork: {
+      id: vnetResourceId
+    }
+    registrationEnabled: false
+  }
+}
+
+output dnsZoneId string = privateDnsZone.id
+output dnsZoneName string = privateDnsZone.name
diff --git a/infra/bicep/modules/container-app.bicep b/infra/bicep/modules/container-app.bicep
index 2156c6d..c98a9e5 100644
--- a/infra/bicep/modules/container-app.bicep
+++ b/infra/bicep/modules/container-app.bicep
@@ -46,6 +46,9 @@ param environmentVariables array = []
 @description('Tags to apply to resources')
 param tags object = {}
 
+@description('Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning).')
+param containerImage string = ''
+
 
 // Use Azure Verified Module for Container App
 module containerApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0' = {
@@ -66,8 +69,8 @@ module containerApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0
     containers: [
       {
         name: name
-        // Use base image as required by azd - will be replaced during deployment
-        image: 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
+        // Use MCR quickstart image for initial provisioning (reachable even with private ACR); azd deploy replaces with real image
+        image: !empty(containerImage) ? containerImage : 'mcr.microsoft.com/k8se/quickstart:latest'
         resources: {
           cpu: cpuCores
           memory: memoryInGB
@@ -88,7 +91,8 @@ module containerApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0
     ]
     ingressAllowInsecure: false
     ingressExternal: externalIngress
-    ingressTargetPort: targetPort
+    // Use port 80 to match placeholder image; azd deploy will update to targetPort with real image
+    ingressTargetPort: 80
     ingressTransport: 'auto'
     activeRevisionsMode: 'Single'
     managedIdentities: {
@@ -100,10 +104,10 @@ module containerApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0
         identity: managedIdentityId
       }
     ]
-    scaleSettings: maxReplicas > 1 ? {
+    scaleSettings: {
       minReplicas: minReplicas
       maxReplicas: maxReplicas
-      rules: [ 
+      rules: maxReplicas > 1 ? [ 
         {
           name: 'http-scaler'
           http: {
@@ -112,8 +116,8 @@ module containerApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0
             }
           }
         }
-      ]
-    } : null
+      ] : []
+    }
   }
 }
 
diff --git a/infra/bicep/modules/container-apps-environment.bicep b/infra/bicep/modules/container-apps-environment.bicep
index c651728..8975159 100644
--- a/infra/bicep/modules/container-apps-environment.bicep
+++ b/infra/bicep/modules/container-apps-environment.bicep
@@ -4,12 +4,8 @@ param containerAppsEnvironmentName string
 @description('Location for all resources')
 param location string = resourceGroup().location
 
-@description('Log Analytics workspace id output from log-analytics-ws.bicep module')
-param logAnalyticsWorkspaceId string
-
-@description('Log Analytics workspace primary shared key output from log-analytics-ws.bicep module')
-@secure()
-param logAnalyticsPrimarySharedKey string 
+@description('Log Analytics workspace resource ID used to derive customer ID and shared key')
+param logAnalyticsWorkspaceResourceId string
 
 @description('User Assigned Identity resource IDs that will be assigned to the Container Apps Environment')
 param userAssignedResourceIds string[]
@@ -31,6 +27,10 @@ param publicNetworkAccess string = 'Enabled'
 @description('Tags for resources')
 param tags object = {}
 
+// Derive Log Analytics credentials from workspace resource ID
+var logAnalyticsCustomerId = reference(logAnalyticsWorkspaceResourceId, '2021-12-01-preview').customerId
+var logAnalyticsSharedKey = listKeys(logAnalyticsWorkspaceResourceId, '2021-12-01-preview').primarySharedKey
+
 // Use Azure Verified Module for Container Apps Environment
 module containerAppsEnvironment 'br:mcr.microsoft.com/bicep/avm/res/app/managed-environment:0.11.3' = {
   name: '${deployment().name}.containerAppsEnvironment'
@@ -42,8 +42,8 @@ module containerAppsEnvironment 'br:mcr.microsoft.com/bicep/avm/res/app/managed-
     appLogsConfiguration: {
       destination: 'log-analytics'
       logAnalyticsConfiguration: {
-        customerId: logAnalyticsWorkspaceId
-        sharedKey: logAnalyticsPrimarySharedKey
+        customerId: logAnalyticsCustomerId
+        sharedKey: logAnalyticsSharedKey
       }
     }
     workloadProfiles: [
diff --git a/infra/bicep/modules/container-registry.bicep b/infra/bicep/modules/container-registry.bicep
index eda929b..0cce25e 100644
--- a/infra/bicep/modules/container-registry.bicep
+++ b/infra/bicep/modules/container-registry.bicep
@@ -28,6 +28,8 @@ param acrPrivateDnsZoneId string = ''
 @allowed(['Enabled', 'Disabled'])
 param publicNetworkAccess string = 'Enabled'
 
+
+
 @description('Zone redundancy setting for the Azure Container Registry')
 @allowed(['Enabled', 'Disabled'])
 param zoneRedundancy string = 'Disabled'
@@ -80,17 +82,15 @@ module containerRegistry 'br:mcr.microsoft.com/bicep/avm/res/container-registry/
         subnetResourceId: privateEndpointSubnetId
         service: 'registry'
         privateLinkServiceConnectionName: '${containerRegistryName}-acr-plsc'
-        privateDnsZoneGroups: [
-          {
-            name: 'acr-dns-zone-group'
-            privateDnsZoneGroupConfigs: !empty(acrPrivateDnsZoneId) ? [
-              {
-                name: 'acr-config'
-                privateDnsZoneResourceId: acrPrivateDnsZoneId
-              }
-            ] : []
-          }
-        ]
+        privateDnsZoneGroup: !empty(acrPrivateDnsZoneId) ? {
+          name: 'acr-dns-zone-group'
+          privateDnsZoneGroupConfigs: [
+            {
+              name: 'acr-config'
+              privateDnsZoneResourceId: acrPrivateDnsZoneId
+            }
+          ]
+        } : null
       }
     ] : []
   }
diff --git a/infra/bicep/modules/cosmos.bicep b/infra/bicep/modules/cosmos.bicep
index 051b952..a14b453 100644
--- a/infra/bicep/modules/cosmos.bicep
+++ b/infra/bicep/modules/cosmos.bicep
@@ -63,17 +63,15 @@ module cosmosAccount 'br:mcr.microsoft.com/bicep/avm/res/document-db/database-ac
         subnetResourceId: privateEndpointSubnetId
         service: 'Sql'
         privateLinkServiceConnectionName: '${cosmosAccountName}-cosmos-plsc'
-        privateDnsZoneGroups: [
-          {
-            name: 'cosmos-dns-zone-group'
-            privateDnsZoneGroupConfigs: !empty(cosmosPrivateDnsZoneId) ? [
-              {
-                name: 'cosmos-config'
-                privateDnsZoneResourceId: cosmosPrivateDnsZoneId
-              }
-            ] : []
-          }
-        ]
+        privateDnsZoneGroup: !empty(cosmosPrivateDnsZoneId) ? {
+          name: 'cosmos-dns-zone-group'
+          privateDnsZoneGroupConfigs: [
+            {
+              name: 'cosmos-config'
+              privateDnsZoneResourceId: cosmosPrivateDnsZoneId
+            }
+          ]
+        } : null
       }
     ] : []
     zoneRedundant: zoneRedundant
diff --git a/infra/bicep/modules/storage.bicep b/infra/bicep/modules/storage.bicep
index 2553e2e..55ddbb2 100644
--- a/infra/bicep/modules/storage.bicep
+++ b/infra/bicep/modules/storage.bicep
@@ -117,17 +117,15 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.27.1' = {
         subnetResourceId: privateEndpointSubnetId
         service: 'blob'
         privateLinkServiceConnectionName: '${storageAccountName}-blob-plsc'
-        privateDnsZoneGroups: [
-          {
-            name: 'blob-dns-zone-group'
-            privateDnsZoneGroupConfigs: [
-              {
-                name: 'blob-config'
-                privateDnsZoneResourceId: blobPrivateDnsZoneId
-              }
-            ]
-          }
-        ]
+        privateDnsZoneGroup: !empty(blobPrivateDnsZoneId) ? {
+          name: 'blob-dns-zone-group'
+          privateDnsZoneGroupConfigs: [
+            {
+              name: 'blob-config'
+              privateDnsZoneResourceId: blobPrivateDnsZoneId
+            }
+          ]
+        } : null
       }
       {
         name: '${storageAccountName}-queue-pe'
@@ -135,17 +133,15 @@ module storageAccount 'br/public:avm/res/storage/storage-account:0.27.1' = {
         subnetResourceId: privateEndpointSubnetId
         service: 'queue'
         privateLinkServiceConnectionName: '${storageAccountName}-queue-plsc'
-        privateDnsZoneGroups: [
-          {
-            name: 'queue-dns-zone-group'
-            privateDnsZoneGroupConfigs: [
-              {
-                name: 'queue-config'
-                privateDnsZoneResourceId: queuePrivateDnsZoneId
-              }
-            ]
-          }
-        ]
+        privateDnsZoneGroup: !empty(queuePrivateDnsZoneId) ? {
+          name: 'queue-dns-zone-group'
+          privateDnsZoneGroupConfigs: [
+            {
+              name: 'queue-config'
+              privateDnsZoneResourceId: queuePrivateDnsZoneId
+            }
+          ]
+        } : null
       }
     ] : []
     blobServices: {
diff --git a/infra/scripts/ailz-resources.env b/infra/scripts/ailz-resources.env
new file mode 100644
index 0000000..9f7f7ac
--- /dev/null
+++ b/infra/scripts/ailz-resources.env
@@ -0,0 +1,18 @@
+# AILZ Resource IDs for ContentFlow Deployment
+# Generated on Fri, Apr 17, 2026 12:38:48 AM
+# AILZ Resource Group: RG-AI-CFSE
+
+EXISTING_VNET_RESOURCE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/Microsoft.Network/virtualNetworks/vnet-wffp43ljodbow"
+PRIVATE_ENDPOINT_SUBNET_NAME="pe-subnet"
+CONTAINER_APPS_SUBNET_NAME="aca-environment-subnet"
+EXISTING_COGNITIVE_SERVICES_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com"
+EXISTING_BLOB_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net"
+EXISTING_COSMOS_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.documents.azure.com"
+EXISTING_APP_CONFIG_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.azconfig.io"
+EXISTING_ACR_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
+# EXISTING_CONTAINER_APPS_ENV_PRIVATE_DNS_ZONE_ID not found
+JUMPBOX_VM_RESOURCE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/Microsoft.Compute/virtualMachines/testvmwffp43ljo"
+JUMPBOX_VM_NAME="testvmwffp43ljo"
+EXISTING_KEY_VAULT_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net"
+EXISTING_LOG_ANALYTICS_WORKSPACE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/Microsoft.OperationalInsights/workspaces/log-wffp43ljodbow"
+EXISTING_APP_INSIGHTS_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/microsoft.insights/components/appi-wffp43ljodbow"
diff --git a/infra/scripts/post-deploy.sh b/infra/scripts/post-deploy.sh
index 0cf3e77..68bc335 100755
--- a/infra/scripts/post-deploy.sh
+++ b/infra/scripts/post-deploy.sh
@@ -1,5 +1,6 @@
 #!/bin/bash
 # Post-deploy hook - runs after all services are deployed
+# Displays endpoints and locks down resources opened during provisioning
 set -e
 
 echo "=================================================="
@@ -20,6 +21,70 @@ echo "Service Endpoints:"
 echo "  API:    $API_ENDPOINT"
 echo "  Web:    $WEB_ENDPOINT"
 echo "  Worker: $WORKER_ENDPOINT"
+echo ""
+
+# ========== SECURITY HARDENING (AILZ mode only) ==========
+DEPLOYMENT_MODE=$(azd env get-value DEPLOYMENT_MODE 2>/dev/null || echo "basic")
+RESOURCE_GROUP=$(azd env get-value AZURE_RESOURCE_GROUP 2>/dev/null || echo "")
+ACR_NAME=$(azd env get-value AZURE_CONTAINER_REGISTRY_NAME 2>/dev/null || echo "")
+
+if [ "$DEPLOYMENT_MODE" = "ailz-integrated" ]; then
+    echo "=================================================="
+    echo "Security Hardening (AILZ mode)"
+    echo "=================================================="
+
+    if [ -z "$RESOURCE_GROUP" ]; then
+        RESOURCE_GROUP=$(az group list --query "[?tags.\"azd-env-name\"=='$(azd env get-value AZURE_ENV_NAME 2>/dev/null)'].name | [0]" -o tsv 2>/dev/null || echo "")
+    fi
+
+    # --- P-1: Disable App Config public access ---
+    echo ""
+    echo "[P-1] Disabling App Config public network access..."
+    APPCONFIG_NAME=$(az resource list --resource-group "$RESOURCE_GROUP" \
+        --resource-type "Microsoft.AppConfiguration/configurationStores" \
+        --query "[?tags.application=='contentflow'].name | [0]" -o tsv 2>/dev/null || echo "")
+    if [ -n "$APPCONFIG_NAME" ]; then
+        az appconfig update --name "$APPCONFIG_NAME" --resource-group "$RESOURCE_GROUP" \
+            --enable-public-network false --only-show-errors 2>/dev/null \
+            && echo "  ✅ App Config '$APPCONFIG_NAME' — public access disabled" \
+            || echo "  ⚠️  Could not disable App Config public access"
+    else
+        echo "  ⚠️  App Config not found — skipping"
+    fi
+
+    # --- P-2: ACR stays private (no action needed) ---
+    echo "[P-2] ACR public access — already Disabled at provisioning (ZTA compliant, no action needed)"
+
+    # --- P-3: Verify private DNS A records ---
+    echo "[P-3] Verifying private DNS zone A records..."
+    for ZONE in "privatelink.azurecr.io" "privatelink.blob.core.windows.net" "privatelink.documents.azure.com" "privatelink.azconfig.io"; do
+        COUNT=$(az network private-dns record-set a list --zone-name "$ZONE" \
+            --resource-group "$RESOURCE_GROUP" --query "length([])" -o tsv 2>/dev/null || echo "0")
+        if [ "$COUNT" -gt 0 ] 2>/dev/null; then
+            echo "  ✅ $ZONE — $COUNT A record(s)"
+        else
+            echo "  ⚠️  $ZONE — no A records (check PE DNS zone groups)"
+        fi
+    done
+
+    # --- P-4: Queue DNS zone ---
+    echo "[P-4] Checking Queue DNS zone..."
+    az network private-dns zone show --name "privatelink.queue.core.windows.net" \
+        --resource-group "$RESOURCE_GROUP" -o none 2>/dev/null \
+        && echo "  ✅ Queue DNS zone exists" \
+        || echo "  ℹ️  No queue DNS zone — queue PE uses public resolution"
+
+    echo ""
+    echo "=================================================="
+    echo "Hardening complete. Remaining manual actions:"
+    echo "  P-5:  Restrict CORS origins to: $WEB_ENDPOINT"
+    echo "  P-6:  Add API authentication (OAuth/JWT middleware)"
+    echo "  P-7:  Disable App Config local auth"
+    echo "  P-8:  Remove storage account Contributor role"
+    echo "  P-9:  Add diagnostic settings to all resources"
+    echo "=================================================="
+fi
+
 echo ""
 echo "Next Steps:"
 echo "  1. Access the web UI at: $WEB_ENDPOINT"
diff --git a/infra/scripts/pre-provision.sh b/infra/scripts/pre-provision.sh
index b1309ba..f668f02 100755
--- a/infra/scripts/pre-provision.sh
+++ b/infra/scripts/pre-provision.sh
@@ -30,6 +30,12 @@ if ! az account show &> /dev/null; then
     exit 1
 fi
 
+# Note: ACR placeholder image import is NOT done here.
+# In AILZ mode, ACR is fully private (publicNetworkAccess=Disabled).
+# Use 'az acr build' (ACR Tasks) during 'azd deploy' to build and push images
+# inside the ACR without requiring public access.
+echo "✓ ACR image build will be handled by ACR Tasks during deployment phase."
+
 echo "=================================================="
 echo "✓ Pre-provision checks completed successfully"
 echo "=================================================="

From c387183c4a3b906c48ba1ff563930b9c91b3c1e1 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Sat, 2 May 2026 19:38:52 +0530
Subject: [PATCH 02/28] Added & updated document validation executor

---
 .../contentflow/executors/__init__.py         |   1 +
 .../executors/azure_openai_agent_executor.py  |   5 +-
 .../executors/content_classifier_executor.py  |   8 +-
 .../executors/document_validation_executor.py | 823 ++++++++++++++++++
 contentflow-lib/executor_catalog.yaml         | 203 ++++-
 infra/bicep/main.bicep                        |   5 +-
 infra/bicep/main.parameters.json              |   3 +
 7 files changed, 1043 insertions(+), 5 deletions(-)
 create mode 100644 contentflow-lib/contentflow/executors/document_validation_executor.py

diff --git a/contentflow-lib/contentflow/executors/__init__.py b/contentflow-lib/contentflow/executors/__init__.py
index 2131973..11dab83 100644
--- a/contentflow-lib/contentflow/executors/__init__.py
+++ b/contentflow-lib/contentflow/executors/__init__.py
@@ -39,6 +39,7 @@
 from .web_scraping_executor import WebScrapingExecutor
 from .pass_through import PassThroughExecutor
 from .cosmos_db_lookup_executor import CosmosDBLookupExecutor
+from .document_validation_executor import DocumentValidationExecutor
 
 # Document Set executors
 from .document_set_initializer import DocumentSetInitializerExecutor
diff --git a/contentflow-lib/contentflow/executors/azure_openai_agent_executor.py b/contentflow-lib/contentflow/executors/azure_openai_agent_executor.py
index 0c842ef..38eaa07 100644
--- a/contentflow-lib/contentflow/executors/azure_openai_agent_executor.py
+++ b/contentflow-lib/contentflow/executors/azure_openai_agent_executor.py
@@ -206,10 +206,11 @@ async def process_content_item(
             
             # Update summary
             content.summary_data['agent_execution_status'] = "success"
-            content.summary_data['response_length'] = len(response_text) if response_text else 0
+            content.summary_data['response_length'] = len(str(response_text)) if response_text else 0
             
             if self.debug_mode:
-                logger.debug(f"Agent response for {content.id}: {response_text[:100]}...")
+                _debug_text = str(response_text)[:100] if response_text else ""
+                logger.debug(f"Agent response for {content.id}: {_debug_text}...")
 
         except Exception as e:
             logger.error(
diff --git a/contentflow-lib/contentflow/executors/content_classifier_executor.py b/contentflow-lib/contentflow/executors/content_classifier_executor.py
index 73b88f8..a704163 100644
--- a/contentflow-lib/contentflow/executors/content_classifier_executor.py
+++ b/contentflow-lib/contentflow/executors/content_classifier_executor.py
@@ -72,8 +72,14 @@ def __init__(
         settings = settings or {}
         categories = settings.get("categories", None)
         
+        # Handle categories passed as JSON string from UI
+        if isinstance(categories, str):
+            categories = [c.strip() for c in categories.strip("[]").split(",") if c.strip()]
+            categories = [c.strip("'\"") for c in categories]
+            settings["categories"] = categories
+        
         if not categories or not isinstance(categories, list) or len(categories) == 0:
-            raise ValueError(f"{self.id}: ContentClassifierExecutor requires 'categories' setting with at least one category")
+            raise ValueError(f"{id}: ContentClassifierExecutor requires 'categories' setting with at least one category")
         
         multi_label = settings.get("multi_label", False)
         include_confidence = settings.get("include_confidence", True)
diff --git a/contentflow-lib/contentflow/executors/document_validation_executor.py b/contentflow-lib/contentflow/executors/document_validation_executor.py
new file mode 100644
index 0000000..bfbc1d7
--- /dev/null
+++ b/contentflow-lib/contentflow/executors/document_validation_executor.py
@@ -0,0 +1,823 @@
+"""
+Document Validation Executor for comparing fetched document details 
+against provided details using configurable validation rules.
+
+This executor reads FetchedDetails_*.json, ProvidedDetails.json, and rules.json
+from an Azure Blob Storage folder, performs field-by-field comparison per document type,
+and writes a consolidated results.json back to the same blob location.
+"""
+
+import asyncio
+import json
+import logging
+from datetime import datetime, timezone
+from typing import Dict, Any, Optional, List, Union
+
+try:
+    from agent_framework.openai import OpenAIChatClient
+    from agent_framework import Agent, AgentResponse
+except ImportError:
+    raise ImportError(
+        "agent-framework import error. Either the library is not installed or there is "
+        "an issue with the version of the installed library."
+    )
+
+from agent_framework import WorkflowContext
+
+from .base import BaseExecutor
+from ..models import Content
+from ..connectors import AzureBlobConnector
+from ..utils.credential_provider import get_azure_credential
+
+logger = logging.getLogger("contentflow.executors.document_validation_executor")
+
+
+class DocumentValidationExecutor(BaseExecutor):
+    """
+    Validate fetched document details against provided details using rules.
+
+    This executor reads FetchedDetails_*.json, ProvidedDetails.json, and rules.json from
+    Azure Blob Storage, performs field-by-field comparison per document type using
+    configurable validation types (exact match, date match, expiry check, name match,
+    address match with AI-powered fuzzy comparison), and writes a consolidated
+    results.json back to the same blob location.
+
+    Configuration (settings dict):
+        - blob_storage_account (str): Azure Storage account name
+          Required: True
+        - blob_container_name (str): Container where input files reside
+          Required: True
+        - blob_storage_credential_type (str): Credential type for blob storage
+          Default: "default_azure_credential"
+          Options: "default_azure_credential", "azure_key_credential"
+        - blob_storage_account_key (str): Storage account key (if using azure_key_credential)
+          Default: None
+        - provided_details_filename (str): Name of the provided details file
+          Default: "ProvidedDetails.json"
+        - rules_filename (str): Name of the rules file
+          Default: "rules.json"
+        - fetched_details_prefix (str): Prefix for fetched details files
+          Default: "FetchedDetails_"
+        - output_filename (str): Name of the output results file
+          Default: "results.json"
+        - case_sensitive_comparison (bool): Whether string comparisons are case-sensitive
+          Default: False
+        - input_prefix_field (str): Field in content.data containing the blob prefix/folder path
+          Default: "blob_path"
+        - endpoint (str): Azure OpenAI endpoint URL for AI-powered address matching
+          Default: None
+        - deployment_name (str): Azure OpenAI model deployment name
+          Default: None
+        - credential_type (str): Azure credential type for OpenAI
+          Default: "default_azure_credential"
+          Options: "default_azure_credential", "azure_key_credential"
+        - api_key (str): API key for Azure OpenAI (if using azure_key_credential)
+          Default: None
+        - temperature (float): Sampling temperature for AI address matching
+          Default: 0.1
+
+    Example:
+        ```yaml
+        - id: document_validator
+          type: document_validation
+          settings:
+            blob_storage_account: "${AZURE_STORAGE_ACCOUNT_NAME}"
+            blob_container_name: "inputs"
+            provided_details_filename: "ProvidedDetails.json"
+            rules_filename: "rules.json"
+            output_filename: "results.json"
+            endpoint: "${AZURE_OPENAI_ENDPOINT}"
+            deployment_name: "gpt-4.1"
+        ```
+
+    Input:
+        Content item representing a case folder (with blob_path in data from
+        upstream blob discovery using virtual_folders mode)
+
+    Output:
+        Content with data["validation_results"] containing the consolidated results,
+        and results.json written to the same blob folder.
+    """
+
+    def __init__(
+        self,
+        id: str,
+        settings: Optional[Dict[str, Any]] = None,
+        **kwargs
+    ):
+        super().__init__(id=id, settings=settings, **kwargs)
+
+        # Blob storage config
+        self.blob_storage_account = self.get_setting("blob_storage_account", required=True)
+        self.blob_container_name = self.get_setting("blob_container_name", required=True)
+        self.blob_storage_credential_type = self.get_setting(
+            "blob_storage_credential_type", default="default_azure_credential"
+        )
+        self.blob_storage_account_key = self.get_setting("blob_storage_account_key", default=None)
+
+        # File names
+        self.provided_details_filename = self.get_setting("provided_details_filename", default="ProvidedDetails.json")
+        self.rules_filename = self.get_setting("rules_filename", default="rules.json")
+        self.fetched_details_prefix = self.get_setting("fetched_details_prefix", default="FetchedDetails_")
+        self.output_filename = self.get_setting("output_filename", default="results.json")
+
+        # Path settings
+        self.base_path = self.get_setting("base_path", default=None)
+        self.fetched_details_path = self.get_setting("fetched_details_path", default=None)
+        self.fetched_details_path_field = self.get_setting("fetched_details_path_field", default="blob_output.blob_path")
+
+        # Comparison settings
+        self.case_sensitive = self.get_setting("case_sensitive_comparison", default=False)
+        self.input_prefix_field = self.get_setting("input_prefix_field", default="blob_path")
+
+        # Azure OpenAI config for AI-powered address matching
+        self.openai_endpoint = self.get_setting("endpoint", default=None)
+        self.openai_deployment_name = self.get_setting("deployment_name", default=None)
+        self.openai_credential_type = self.get_setting("credential_type", default="default_azure_credential")
+        self.openai_api_key = self.get_setting("api_key", default=None)
+        self.temperature = self.get_setting("temperature", default=0.1)
+
+        # Validate OpenAI credential config
+        if self.openai_credential_type not in ["default_azure_credential", "azure_key_credential"]:
+            raise ValueError(f"{self.id}: Invalid credential_type '{self.openai_credential_type}'")
+        if self.openai_credential_type == "azure_key_credential" and not self.openai_api_key:
+            raise ValueError(f"{self.id}: api_key must be provided for azure_key_credential")
+
+        # Initialize blob connector
+        self.blob_connector = AzureBlobConnector(
+            name="validation_blob_connector",
+            settings={
+                "account_name": self.blob_storage_account,
+                "credential_type": self.blob_storage_credential_type,
+                "credential_key": self.blob_storage_account_key,
+            }
+        )
+
+        # AI agent (lazily initialized)
+        self.agent: Optional[Agent] = None
+
+        if self.debug_mode:
+            logger.debug(f"DocumentValidationExecutor {self.id} initialized")
+
+    def _init_agent(self) -> None:
+        """Initialize the AI agent for address matching."""
+        client_kwargs = {
+            "model": self.openai_deployment_name,
+            "azure_endpoint": self.openai_endpoint,
+            "credential": get_azure_credential() if self.openai_credential_type == "default_azure_credential" else None,
+            "api_key": self.openai_api_key if self.openai_credential_type == "azure_key_credential" else None,
+        }
+
+        client = OpenAIChatClient(**client_kwargs)
+
+        instructions = (
+            "You are an address comparison expert. You will be given two addresses and must determine "
+            "if they refer to the same physical location. Consider abbreviations, formatting differences, "
+            "partial matches, and regional address conventions (especially Puerto Rico/US formats). "
+            "Respond ONLY with a JSON object: {\"match\": true/false, \"confidence\": 0.0-1.0, \"reason\": \"brief explanation\"}"
+        )
+
+        self.agent = client.as_agent(
+            id=f"{self.id}_address_agent",
+            name=f"{self.id}_address_agent",
+            instructions=instructions,
+            default_options={
+                "temperature": self.temperature,
+                "max_tokens": 150
+            },
+        )
+
+    async def process_input(
+        self,
+        input: Union[Content, List[Content]],
+        ctx: WorkflowContext[Union[Content, List[Content]], Union[Content, List[Content]]]
+    ) -> Union[Content, List[Content]]:
+        """Main processing: load files, compare, produce results."""
+        if isinstance(input, list):
+            results = []
+            for content in input:
+                results.append(await self._process_single(content))
+            return results
+        return await self._process_single(input)
+
+    async def _process_single(self, content: Content) -> Content:
+        """Process a single case (folder)."""
+        await self.blob_connector.initialize()
+
+        # Determine the blob prefix for ProvidedDetails, rules, and output
+        base_prefix = self._get_base_prefix(content)
+        # Determine where FetchedDetails files are stored (may differ from base)
+        fetched_prefix = self._get_fetched_details_prefix(content)
+
+        logger.info(f"{self.id}: Base path: {base_prefix}, Fetched details path: {fetched_prefix}")
+
+        # Step 1: Load ProvidedDetails.json
+        provided_details = await self._load_json_from_blob(base_prefix, self.provided_details_filename)
+        if self.debug_mode:
+            logger.debug(f"{self.id}: Loaded ProvidedDetails with {len(provided_details.get('documents', []))} documents")
+
+        # Step 2: Load rules.json
+        rules = await self._load_json_from_blob(base_prefix, self.rules_filename)
+        if self.debug_mode:
+            logger.debug(f"{self.id}: Loaded rules with {len(rules.get('rules', []))} document type rules")
+
+        # Step 3: Discover and load all FetchedDetails_*.json files
+        fetched_details_list = await self._load_all_fetched_details(fetched_prefix)
+        if self.debug_mode:
+            logger.debug(f"{self.id}: Loaded {len(fetched_details_list)} fetched detail entries")
+
+        # Step 4: Run validation
+        results = await self._run_validation(provided_details, fetched_details_list, rules)
+
+        # Step 5: Write results.json to base path
+        await self._write_results_to_blob(base_prefix, results)
+
+        # Step 6: Store results in content for downstream use
+        content.data["validation_results"] = results
+        content.summary_data["validation_status"] = results.get("summary", {}).get("overallStatus", "unknown")
+
+        logger.info(
+            f"{self.id}: Validation complete - "
+            f"Status: {results['summary']['overallStatus']}, "
+            f"Passed: {results['summary']['passed']}, Failed: {results['summary']['failed']}"
+        )
+
+        return content
+
+    def _get_base_prefix(self, content: Content) -> str:
+        """Get the base path for ProvidedDetails, rules, and results output.
+        
+        Priority: static base_path setting > content field > content.id.path
+        """
+        # If static base_path is set, use it directly
+        if self.base_path:
+            path = self.base_path.strip("/")
+            return f"{path}/" if path else ""
+
+        # Fall back to dynamic resolution from content
+        prefix = self.try_extract_nested_field_from_content(content, self.input_prefix_field)
+        if prefix:
+            return prefix if prefix.endswith("/") else prefix + "/"
+        if content.id and content.id.path:
+            path = content.id.path
+            return path if path.endswith("/") else path + "/"
+        raise ValueError(f"{self.id}: Cannot determine base path. Set 'base_path' in settings.")
+
+    def _get_fetched_details_prefix(self, content: Content) -> str:
+        """Get the path where FetchedDetails files are stored.
+        
+        Priority:
+          1. Static fetched_details_path setting (manual override)
+          2. Derived from upstream blob output (content.summary_data nested field)
+          3. Fall back to base_path
+        """
+        # 1. Static override
+        if self.fetched_details_path:
+            path = self.fetched_details_path.strip("/")
+            return f"{path}/" if path else ""
+
+        # 2. Derive from upstream blob output path
+        #    The blob output executor stores: content.summary_data['blob_output']['blob_path']
+        #    e.g., "azure_blob_output-xxx_2026_05_01/FetchedDetails_abc.json"
+        upstream_path = self._resolve_nested_field(content.summary_data, self.fetched_details_path_field)
+        
+        if upstream_path:
+            # Extract directory from full blob path
+            if "/" in upstream_path:
+                folder = upstream_path.rsplit("/", 1)[0]
+                return f"{folder}/"
+            # If no slash, it's a file at root level
+            return ""
+
+        # 3. Fall back to base path
+        return self._get_base_prefix(content)
+
+    def _resolve_nested_field(self, data: dict, field_path: str):
+        """Resolve a dot-notation field path from a dictionary.
+        
+        E.g., 'blob_output.blob_path' resolves data['blob_output']['blob_path']
+        """
+        if not data or not field_path:
+            return None
+        parts = field_path.split(".")
+        value = data
+        for part in parts:
+            if isinstance(value, dict) and part in value:
+                value = value[part]
+            else:
+                return None
+        return value if value is not data else None
+
+    async def _load_json_from_blob(self, prefix: str, filename: str) -> dict:
+        """Download and parse a JSON file from blob storage."""
+        blob_path = f"{prefix}{filename}"
+        try:
+            content_bytes = await self.blob_connector.download_blob(
+                container_name=self.blob_container_name,
+                blob_path=blob_path
+            )
+            return json.loads(content_bytes.decode("utf-8"))
+        except Exception as e:
+            logger.error(f"{self.id}: Failed to load {blob_path}: {e}")
+            raise ValueError(f"Failed to load required file '{filename}' from {blob_path}: {e}")
+
+    async def _load_all_fetched_details(self, fetched_prefix: str) -> List[dict]:
+        """Find and load all FetchedDetails_*.json files in the fetched details path."""
+        all_fetched = []
+        async for blobs in self.blob_connector.list_blobs(
+            container_name=self.blob_container_name,
+            prefix=fetched_prefix,
+            max_results=100,
+            batch_size=100
+        ):
+            if not blobs:
+                continue
+            for blob in blobs:
+                blob_name = blob.get("name", "")
+                filename = blob_name.split("/")[-1] if "/" in blob_name else blob_name
+                if filename.startswith(self.fetched_details_prefix) and filename.endswith(".json"):
+                    try:
+                        content_bytes = await self.blob_connector.download_blob(
+                            container_name=self.blob_container_name,
+                            blob_path=blob_name
+                        )
+                        fetched = json.loads(content_bytes.decode("utf-8"))
+                        if isinstance(fetched, list):
+                            all_fetched.extend(fetched)
+                        else:
+                            all_fetched.append(fetched)
+                    except Exception as e:
+                        logger.warning(f"{self.id}: Failed to load fetched details from {blob_name}: {e}")
+        return all_fetched
+
+    async def _run_validation(
+        self,
+        provided_details: dict,
+        fetched_details_list: List[dict],
+        rules: dict
+    ) -> dict:
+        """
+        Core validation logic:
+        - Match fetched documents to provided documents by documentType
+        - Apply rules for each document type
+        - Produce consolidated results
+        """
+        results = {
+            "validationTimestamp": datetime.now(timezone.utc).isoformat(),
+            "summary": {
+                "totalDocuments": 0,
+                "passed": 0,
+                "failed": 0,
+                "warnings": 0,
+                "notFound": 0,
+                "overallStatus": "passed"
+            },
+            "documentResults": []
+        }
+
+        provided_docs = {
+            doc["documentType"]: doc["details"]
+            for doc in provided_details.get("documents", [])
+        }
+        rules_by_type = {
+            rule["documentType"]: rule["validations"]
+            for rule in rules.get("rules", [])
+        }
+
+        for fetched in fetched_details_list:
+            fetched_doc_type = fetched.get("document_type", "")
+            doc_result = {
+                "documentType": fetched_doc_type,
+                "status": "passed",
+                "errors": [],
+                "fieldResults": []
+            }
+            results["summary"]["totalDocuments"] += 1
+
+            # Find matching provided document
+            provided = self._find_matching_provided(fetched_doc_type, provided_docs)
+            if provided is None:
+                doc_result["status"] = "not_found"
+                doc_result["errors"].append({
+                    "errorCode": "DOC_NOT_IN_PROVIDED",
+                    "message_en": f"Document type '{fetched_doc_type}' not found in ProvidedDetails.",
+                    "message_es": f"Tipo de documento '{fetched_doc_type}' no encontrado en los detalles proporcionados."
+                })
+                results["summary"]["notFound"] += 1
+                results["documentResults"].append(doc_result)
+                continue
+
+            # Find matching rules
+            validations = self._find_matching_rules(fetched_doc_type, rules_by_type)
+            if not validations:
+                # No rules means no validation needed - pass through
+                doc_result["status"] = "passed"
+                doc_result["fieldResults"].append({
+                    "field": "_meta",
+                    "result": "skipped",
+                    "message_en": f"No validation rules defined for document type '{fetched_doc_type}'."
+                })
+                results["summary"]["passed"] += 1
+                results["documentResults"].append(doc_result)
+                continue
+
+            # Extract fetched field values from Azure CU output
+            fetched_fields = self._extract_fetched_fields(fetched)
+
+            # Apply each validation rule
+            for validation in validations:
+                field_result = await self._validate_field(validation, fetched_fields, provided, fetched_doc_type)
+                doc_result["fieldResults"].append(field_result)
+                if field_result["result"] == "fail":
+                    doc_result["status"] = "failed"
+
+            # Update summary
+            if doc_result["status"] == "failed":
+                results["summary"]["failed"] += 1
+            else:
+                results["summary"]["passed"] += 1
+
+            results["documentResults"].append(doc_result)
+
+        # Set overall status
+        if results["summary"]["failed"] > 0 or results["summary"]["notFound"] > 0:
+            results["summary"]["overallStatus"] = "failed"
+
+        return results
+
+    def _find_matching_provided(self, fetched_type: str, provided_docs: dict) -> Optional[dict]:
+        """Match fetched document_type to ProvidedDetails documentType."""
+        # Exact match first
+        if fetched_type in provided_docs:
+            return provided_docs[fetched_type]
+        # Case-insensitive match
+        for key, val in provided_docs.items():
+            if key.lower() == fetched_type.lower():
+                return val
+        # Partial/contains match (e.g., "Telecom Utility bill" matches "Telecom utility bill_claro")
+        for key, val in provided_docs.items():
+            if fetched_type.lower() in key.lower() or key.lower() in fetched_type.lower():
+                return val
+        return None
+
+    def _find_matching_rules(self, fetched_type: str, rules_by_type: dict) -> Optional[List[dict]]:
+        """Match fetched document type to rules."""
+        # Exact match
+        if fetched_type in rules_by_type:
+            return rules_by_type[fetched_type]
+        # Case-insensitive match
+        for key, val in rules_by_type.items():
+            if key.lower() == fetched_type.lower():
+                return val
+        # Partial match for variants (e.g., "Telecom Utility bill" partial matches "Telecom utility bill_claro")
+        for key, val in rules_by_type.items():
+            if fetched_type.lower() in key.lower() or key.lower() in fetched_type.lower():
+                return val
+        return None
+
+    def _extract_fetched_fields(self, fetched: dict) -> Dict[str, Any]:
+        """
+        Extract field values from the Azure Content Understanding response.
+        Returns dict like {"FirstName": "LIZANDRA", "LastName": "MARTES SIERRA", ...}
+        """
+        fields = {}
+        try:
+            contents = fetched.get("details", {}).get("result", {}).get("contents", [])
+            if contents:
+                raw_fields = contents[0].get("fields", {})
+                for field_name, field_data in raw_fields.items():
+                    if field_data.get("type") == "date":
+                        value = field_data.get("valueDate")
+                    else:
+                        value = field_data.get("valueString")
+                    if value:
+                        fields[field_name] = value
+        except (KeyError, IndexError, TypeError) as e:
+            logger.warning(f"{self.id}: Error extracting fetched fields: {e}")
+        return fields
+
+    async def _validate_field(
+        self,
+        validation: dict,
+        fetched_fields: Dict[str, Any],
+        provided: dict,
+        doc_type: str
+    ) -> dict:
+        """Apply a single validation rule and return the field result."""
+        field = validation.get("field", "")
+        validation_type = validation.get("validationType", "exact_match")
+        error_code = validation.get("errorCode", "")
+
+        result = {
+            "field": field,
+            "validationType": validation_type,
+            "errorCode": error_code,
+            "result": "pass",
+            "fetchedValue": None,
+            "providedValue": None,
+            "message_en": None,
+            "message_es": None
+        }
+
+        # Dispatch based on validation type
+        if validation_type == "expiry_check":
+            await self._check_expiry(result, field, fetched_fields, provided, validation)
+        elif validation_type == "exact_match":
+            self._check_exact_match(result, field, fetched_fields, provided, validation)
+        elif validation_type == "date_match":
+            self._check_date_match(result, field, fetched_fields, provided, validation)
+        elif validation_type == "name_match":
+            self._check_name_match(result, field, fetched_fields, provided, validation)
+        elif validation_type == "address_match":
+            await self._check_address_match(result, field, fetched_fields, provided, validation)
+        else:
+            # Default to exact match
+            self._check_exact_match(result, field, fetched_fields, provided, validation)
+
+        return result
+
+    async def _check_expiry(
+        self, result: dict, field: str,
+        fetched_fields: dict, provided: dict, validation: dict
+    ) -> None:
+        """Check if a document has expired."""
+        fetched_value = fetched_fields.get(field)
+        provided_value = provided.get(field)
+        result["fetchedValue"] = fetched_value
+        result["providedValue"] = provided_value
+
+        # If provided says "Permanent", it never expires
+        if provided_value and str(provided_value).lower() == "permanent":
+            result["result"] = "pass"
+            return
+
+        # Use fetched expiry date for the check
+        date_to_check = fetched_value or provided_value
+        if date_to_check:
+            try:
+                exp_date = datetime.strptime(str(date_to_check), "%Y-%m-%d")
+                if exp_date < datetime.now():
+                    result["result"] = "fail"
+                    result["message_en"] = validation.get("message_en")
+                    result["message_es"] = validation.get("message_es")
+            except ValueError:
+                result["result"] = "warning"
+                result["message_en"] = f"Could not parse expiry date: {date_to_check}"
+        else:
+            result["result"] = "warning"
+            result["message_en"] = "Expiry date not found in fetched or provided details"
+
+    def _check_exact_match(
+        self, result: dict, field: str,
+        fetched_fields: dict, provided: dict, validation: dict
+    ) -> None:
+        """Exact string comparison (case-insensitive by default)."""
+        fetched_value = fetched_fields.get(field)
+        provided_value = provided.get(field)
+        result["fetchedValue"] = fetched_value
+        result["providedValue"] = provided_value
+
+        if fetched_value is None:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in fetched document details"
+            return
+        if provided_value is None:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in provided details"
+            return
+
+        if not self._values_match(str(fetched_value), str(provided_value)):
+            result["result"] = "fail"
+            result["message_en"] = validation.get("message_en")
+            result["message_es"] = validation.get("message_es")
+
+    def _check_date_match(
+        self, result: dict, field: str,
+        fetched_fields: dict, provided: dict, validation: dict
+    ) -> None:
+        """Date comparison (normalizes to YYYY-MM-DD)."""
+        fetched_value = fetched_fields.get(field)
+        provided_value = provided.get(field)
+        result["fetchedValue"] = fetched_value
+        result["providedValue"] = provided_value
+
+        if fetched_value is None:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in fetched document details"
+            return
+        if provided_value is None:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in provided details"
+            return
+
+        # Normalize dates for comparison
+        fetched_normalized = self._normalize_date(str(fetched_value))
+        provided_normalized = self._normalize_date(str(provided_value))
+
+        if fetched_normalized and provided_normalized:
+            if fetched_normalized != provided_normalized:
+                result["result"] = "fail"
+                result["message_en"] = validation.get("message_en")
+                result["message_es"] = validation.get("message_es")
+        else:
+            # Fallback to string comparison
+            if not self._values_match(str(fetched_value), str(provided_value)):
+                result["result"] = "fail"
+                result["message_en"] = validation.get("message_en")
+                result["message_es"] = validation.get("message_es")
+
+    def _check_name_match(
+        self, result: dict, field: str,
+        fetched_fields: dict, provided: dict, validation: dict
+    ) -> None:
+        """
+        Name comparison for full name fields.
+        For utility bills: concatenates FirstName + LastName from fetched, compares to FullName in provided.
+        """
+        provided_value = provided.get(field)
+
+        # Build fetched full name from FirstName + LastName if field is FullName
+        if field == "FullName":
+            first = fetched_fields.get("FirstName", "")
+            last = fetched_fields.get("LastName", "")
+            fetched_value = f"{first} {last}".strip()
+        else:
+            fetched_value = fetched_fields.get(field)
+
+        result["fetchedValue"] = fetched_value
+        result["providedValue"] = provided_value
+
+        if not fetched_value:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in fetched document details"
+            return
+        if not provided_value:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in provided details"
+            return
+
+        if not self._names_match(str(fetched_value), str(provided_value)):
+            result["result"] = "fail"
+            result["message_en"] = validation.get("message_en")
+            result["message_es"] = validation.get("message_es")
+
+    async def _check_address_match(
+        self, result: dict, field: str,
+        fetched_fields: dict, provided: dict, validation: dict
+    ) -> None:
+        """AI-powered address comparison using Azure OpenAI."""
+        fetched_value = fetched_fields.get(field)
+        provided_value = provided.get(field)
+        result["fetchedValue"] = fetched_value
+        result["providedValue"] = provided_value
+
+        if not fetched_value:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in fetched document details"
+            return
+        if not provided_value:
+            result["result"] = "warning"
+            result["message_en"] = f"Field '{field}' not found in provided details"
+            return
+
+        # Also append Region if available for more complete address
+        region = fetched_fields.get("Region")
+        full_fetched_address = fetched_value
+        if region and region not in fetched_value:
+            full_fetched_address = f"{fetched_value}, {region}"
+
+        # Use AI-powered comparison if endpoint is configured
+        if self.openai_endpoint and self.openai_deployment_name:
+            is_match = await self._ai_address_match(full_fetched_address, str(provided_value))
+            if not is_match:
+                result["result"] = "fail"
+                result["message_en"] = validation.get("message_en")
+                result["message_es"] = validation.get("message_es")
+        else:
+            # Fallback to basic string comparison
+            if not self._values_match(str(full_fetched_address), str(provided_value)):
+                result["result"] = "fail"
+                result["message_en"] = validation.get("message_en")
+                result["message_es"] = validation.get("message_es")
+
+    async def _ai_address_match(self, address1: str, address2: str) -> bool:
+        """Use Azure OpenAI to determine if two addresses match."""
+        if not self.agent:
+            self._init_agent()
+
+        query = (
+            f"Address 1: {address1}\n"
+            f"Address 2: {address2}\n\n"
+            f"Do these two addresses refer to the same physical location?"
+        )
+
+        try:
+            response: AgentResponse = await self.agent.run(query)
+            response_text = response.content if hasattr(response, "content") else str(response)
+
+            # Parse the JSON response
+            try:
+                parsed = json.loads(response_text)
+                match_result = parsed.get("match", False)
+                confidence = parsed.get("confidence", 0.0)
+
+                if self.debug_mode:
+                    logger.debug(
+                        f"{self.id}: Address match result: {match_result}, "
+                        f"confidence: {confidence}, reason: {parsed.get('reason', '')}"
+                    )
+
+                return bool(match_result)
+            except json.JSONDecodeError:
+                # If response isn't valid JSON, look for keywords
+                lower_response = response_text.lower()
+                return "true" in lower_response or "match" in lower_response
+
+        except Exception as e:
+            logger.warning(f"{self.id}: AI address match failed, falling back to string comparison: {e}")
+            return self._values_match(address1, address2)
+
+    def _values_match(self, fetched: str, provided: str) -> bool:
+        """Compare two string values with normalization."""
+        if not fetched or not provided:
+            return False
+        f = fetched.strip()
+        p = provided.strip()
+        if not self.case_sensitive:
+            f = f.upper()
+            p = p.upper()
+        # Exact match
+        if f == p:
+            return True
+        # Contained match (one contains the other)
+        if f in p or p in f:
+            return True
+        return False
+
+    def _names_match(self, fetched: str, provided: str) -> bool:
+        """
+        Compare names with flexible matching.
+        Handles: "LASTNAME, FIRSTNAME" vs "FIRSTNAME LASTNAME" formats,
+        and partial name matching.
+        """
+        if not fetched or not provided:
+            return False
+
+        f = fetched.strip().upper()
+        p = provided.strip().upper()
+
+        # Direct match
+        if f == p:
+            return True
+
+        # Normalize comma-separated format ("OROZCO DONES, CARMEN" → "CARMEN OROZCO DONES")
+        f_normalized = self._normalize_name(f)
+        p_normalized = self._normalize_name(p)
+
+        if f_normalized == p_normalized:
+            return True
+
+        # Check if all parts of one name appear in the other
+        f_parts = set(f_normalized.split())
+        p_parts = set(p_normalized.split())
+
+        # If all parts of the shorter name are in the longer name
+        if f_parts.issubset(p_parts) or p_parts.issubset(f_parts):
+            return True
+
+        # Check significant overlap (at least first+last name match)
+        common = f_parts.intersection(p_parts)
+        if len(common) >= 2:
+            return True
+
+        return False
+
+    def _normalize_name(self, name: str) -> str:
+        """Normalize name format: 'LAST, FIRST' → 'FIRST LAST'."""
+        if "," in name:
+            parts = name.split(",", 1)
+            return f"{parts[1].strip()} {parts[0].strip()}"
+        return name
+
+    def _normalize_date(self, date_str: str) -> Optional[str]:
+        """Normalize date to YYYY-MM-DD format."""
+        formats = ["%Y-%m-%d", "%m/%d/%Y", "%d/%m/%Y", "%Y-%m-%dT%H:%M:%S", "%d %b %Y", "%b %d, %Y"]
+        for fmt in formats:
+            try:
+                dt = datetime.strptime(date_str.strip(), fmt)
+                return dt.strftime("%Y-%m-%d")
+            except ValueError:
+                continue
+        return None
+
+    async def _write_results_to_blob(self, prefix: str, results: dict) -> None:
+        """Write results.json back to the same blob folder."""
+        blob_path = f"{prefix}{self.output_filename}"
+        content_bytes = json.dumps(results, indent=2, ensure_ascii=False).encode("utf-8")
+        await self.blob_connector.upload_blob(
+            container_name=self.blob_container_name,
+            blob_path=blob_path,
+            data=content_bytes,
+            overwrite=True
+        )
+        logger.info(f"{self.id}: Wrote validation results to {blob_path}")
diff --git a/contentflow-lib/executor_catalog.yaml b/contentflow-lib/executor_catalog.yaml
index 1e99ad5..03299e4 100644
--- a/contentflow-lib/executor_catalog.yaml
+++ b/contentflow-lib/executor_catalog.yaml
@@ -6246,4 +6246,205 @@ executor_catalog:
     ui_metadata:
       icon: "database"
       description_short: "Look up records in Cosmos DB NoSQL"
-      description_long: "Queries Azure Cosmos DB NoSQL containers to validate or enrich content fields. Supports both direct point-reads (by id and partition key) and parameterised SQL queries. Lookup values are extracted from content.data via configurable field mappings and results are written back into each content item."
\ No newline at end of file
+      description_long: "Queries Azure Cosmos DB NoSQL containers to validate or enrich content fields. Supports both direct point-reads (by id and partition key) and parameterised SQL queries. Lookup values are extracted from content.data via configurable field mappings and results are written back into each content item."
+
+  ########################################################
+  # Document Validation Executor
+  - id: document_validation
+    name: "Document Validation"
+    description: "Validates fetched document details against provided details using configurable rules. Supports exact match, date match, expiry check, name match, and AI-powered address matching."
+    module_path: contentflow.executors.document_validation_executor
+    class_name: DocumentValidationExecutor
+    tags: [validation, comparison, rules, documents, azure-openai]
+    category: "analyse"
+    version: "1.2"
+
+    settings_schema:
+      # Common settings
+      enabled:
+        type: boolean
+        title: "Enabled"
+        description: "Enable or disable this executor"
+        required: false
+        default: true
+        ui_component: "checkbox"
+
+      fail_pipeline_on_error:
+        type: boolean
+        title: "Fail Pipeline On Error"
+        description: "Fail the entire pipeline if validation execution fails"
+        required: false
+        default: true
+        ui_component: "checkbox"
+
+      debug_mode:
+        type: boolean
+        title: "Debug Mode"
+        description: "Enable debug mode for detailed logging"
+        required: false
+        default: false
+        ui_component: "checkbox"
+
+      # Blob storage settings
+      blob_storage_account:
+        type: string
+        title: "Blob Storage Account"
+        description: "Azure Blob Storage account name where input files reside"
+        placeholder: "<enter storage account name>"
+        required: true
+        default: null
+        ui_component: "input"
+
+      blob_container_name:
+        type: string
+        title: "Container Name"
+        description: "Azure Blob Storage container name containing the case folders"
+        placeholder: "<enter container name>"
+        required: true
+        default: null
+        ui_component: "input"
+
+      blob_storage_credential_type:
+        type: string
+        title: "Blob Storage Credential Type"
+        description: "Credential type for accessing Azure Blob Storage"
+        required: false
+        default: "default_azure_credential"
+        options: ["default_azure_credential", "azure_key_credential"]
+        ui_component: "select"
+
+      blob_storage_account_key:
+        type: string
+        title: "Blob Storage Account Key"
+        description: "Azure Blob Storage account key (if using azure_key_credential)"
+        required: false
+        default: null
+        ui_component: "password"
+
+      # File configuration
+      provided_details_filename:
+        type: string
+        title: "Provided Details Filename"
+        description: "Name of the file containing provided/expected details"
+        required: false
+        default: "ProvidedDetails.json"
+        ui_component: "input"
+
+      rules_filename:
+        type: string
+        title: "Rules Filename"
+        description: "Name of the file containing validation rules"
+        required: false
+        default: "rules.json"
+        ui_component: "input"
+
+      fetched_details_prefix:
+        type: string
+        title: "Fetched Details Prefix"
+        description: "Filename prefix for fetched details files (e.g., 'FetchedDetails_')"
+        required: false
+        default: "FetchedDetails_"
+        ui_component: "input"
+
+      output_filename:
+        type: string
+        title: "Output Filename"
+        description: "Name of the output results file"
+        required: false
+        default: "results.json"
+        ui_component: "input"
+
+      # Path settings
+      base_path:
+        type: string
+        title: "Base Path"
+        description: "Static blob folder path where ProvidedDetails.json, rules.json reside and results.json will be written (e.g., 'inputs'). If not set, derived from content."
+        placeholder: "inputs"
+        required: false
+        default: null
+        ui_component: "input"
+
+      fetched_details_path:
+        type: string
+        title: "Fetched Details Path"
+        description: "Static blob folder path where FetchedDetails_*.json files are stored. If not set, automatically derived from upstream blob output executor's written path."
+        placeholder: "azure_blob_output-xxx_2026_05_01"
+        required: false
+        default: null
+        ui_component: "input"
+
+      fetched_details_path_field:
+        type: string
+        title: "Fetched Details Path Field"
+        description: "Dot-notation path in content.summary_data to the blob path written by upstream blob output executor (e.g., 'blob_output.blob_path')"
+        required: false
+        default: "blob_output.blob_path"
+        ui_component: "input"
+
+      # Comparison settings
+      case_sensitive_comparison:
+        type: boolean
+        title: "Case Sensitive Comparison"
+        description: "Whether string comparisons should be case-sensitive"
+        required: false
+        default: false
+        ui_component: "checkbox"
+
+      input_prefix_field:
+        type: string
+        title: "Input Prefix Field"
+        description: "Field in content.data containing the blob folder path for this case"
+        required: false
+        default: "blob_path"
+        ui_component: "input"
+
+      # Azure OpenAI settings for AI-powered address matching
+      endpoint:
+        type: string
+        title: "Azure OpenAI Endpoint"
+        description: "Azure OpenAI endpoint URL for AI-powered address matching"
+        placeholder: "https://<your-resource>.openai.azure.com/"
+        required: false
+        default: null
+        ui_component: "input"
+
+      deployment_name:
+        type: string
+        title: "Deployment Name"
+        description: "Azure OpenAI model deployment name (e.g., gpt-4.1)"
+        placeholder: "gpt-4.1"
+        required: false
+        default: null
+        ui_component: "input"
+
+      credential_type:
+        type: string
+        title: "OpenAI Credential Type"
+        description: "Authentication method for Azure OpenAI"
+        required: false
+        default: "default_azure_credential"
+        options: ["default_azure_credential", "azure_key_credential"]
+        ui_component: "select"
+
+      api_key:
+        type: string
+        title: "OpenAI API Key"
+        description: "API key for Azure OpenAI (if using azure_key_credential)"
+        required: false
+        default: null
+        ui_component: "password"
+
+      temperature:
+        type: number
+        title: "Temperature"
+        description: "Sampling temperature for AI address matching (0.0-1.0)"
+        required: false
+        default: 0.1
+        min: 0.0
+        max: 1.0
+        ui_component: "number"
+
+    ui_metadata:
+      icon: "check-circle"
+      description_short: "Validate documents against provided details"
+      description_long: "Compares fetched document details (from Azure Content Understanding) against provided/expected details using configurable validation rules. Supports exact match, date match, expiry check, name matching, and AI-powered fuzzy address comparison. Reads ProvidedDetails.json, rules.json, and FetchedDetails_*.json from a blob folder and writes consolidated results.json back to the same location."
\ No newline at end of file
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index 47af02c..a36920a 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -21,6 +21,9 @@ param location string = resourceGroup().location
 @description('Location for AI Foundry resources')
 param foundryLocation string
 
+@description('Location for Cosmos DB resources (override if primary region has capacity issues)')
+param cosmosLocation string = location
+
 @description('ID of the user running the deployment')
 param principalId string = ''
 
@@ -232,7 +235,7 @@ module storage 'modules/storage.bicep' = {
 module cosmos 'modules/cosmos.bicep' = {
   name: 'cosmos-${resourceToken}'
   params: {
-    location: location
+    location: cosmosLocation
     cosmosAccountName: cosmosAccountName
     cosmosDbName: cosmosDbName
     cosmosDBContainerNames: cosmosDBContainerNames
diff --git a/infra/bicep/main.parameters.json b/infra/bicep/main.parameters.json
index 57ef45e..ed765b5 100644
--- a/infra/bicep/main.parameters.json
+++ b/infra/bicep/main.parameters.json
@@ -14,6 +14,9 @@
     "foundryLocation": {
       "value": "${AZURE_AI_FOUNDRY_LOCATION}"
     },
+    "cosmosLocation": {
+      "value": "${AZURE_COSMOS_LOCATION=eastus2}"
+    },
     "principalId": {
       "value": "${AZURE_PRINCIPAL_ID}"
     },

From a2c957fe31b8c113decac4b983cacf2f27dac806 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Tue, 5 May 2026 14:35:30 +0530
Subject: [PATCH 03/28] Custom executor logging and role assignment check

---
 contentflow-lib/contentflow/executors/base.py |  17 +-
 .../executors/document_validation_executor.py | 233 ++++++++++++++----
 .../app/worker/processing_worker.py           |   4 +
 infra/bicep/main.bicep                        |  14 ++
 infra/bicep/main.parameters.json              |   3 +
 .../modules/openai-role-assignment.bicep      |  31 +++
 6 files changed, 259 insertions(+), 43 deletions(-)
 create mode 100644 infra/bicep/modules/openai-role-assignment.bicep

diff --git a/contentflow-lib/contentflow/executors/base.py b/contentflow-lib/contentflow/executors/base.py
index e4488aa..f4ba077 100644
--- a/contentflow-lib/contentflow/executors/base.py
+++ b/contentflow-lib/contentflow/executors/base.py
@@ -172,7 +172,22 @@ def get_setting(
                 )
             return default
         
-        return self._resolve_setting_value(value)
+        resolved = self._resolve_setting_value(value)
+        
+        # Warn if a sensitive setting appears to contain a literal value instead of ${ENV_VAR}
+        _sensitive_keywords = ('key', 'secret', 'password', 'credential', 'token', 'api_key')
+        if (
+            isinstance(value, str)
+            and any(kw in setting_key.lower() for kw in _sensitive_keywords)
+            and not (value.startswith('${') and value.endswith('}'))
+            and value != default
+        ):
+            logger.warning(
+                f"Executor '{self.id}': Setting '{setting_key}' appears to contain a literal secret. "
+                f"Use ${{ENV_VAR}} syntax to reference environment variables for ZTA compliance."
+            )
+        
+        return resolved
     
     def try_extract_nested_field_from_content(
         self,
diff --git a/contentflow-lib/contentflow/executors/document_validation_executor.py b/contentflow-lib/contentflow/executors/document_validation_executor.py
index bfbc1d7..1f09d2f 100644
--- a/contentflow-lib/contentflow/executors/document_validation_executor.py
+++ b/contentflow-lib/contentflow/executors/document_validation_executor.py
@@ -25,7 +25,7 @@
 from agent_framework import WorkflowContext
 
 from .base import BaseExecutor
-from ..models import Content
+from ..models import Content, ExecutorLogEntry
 from ..connectors import AzureBlobConnector
 from ..utils.credential_provider import get_azure_credential
 
@@ -192,55 +192,140 @@ async def process_input(
         input: Union[Content, List[Content]],
         ctx: WorkflowContext[Union[Content, List[Content]], Union[Content, List[Content]]]
     ) -> Union[Content, List[Content]]:
-        """Main processing: load files, compare, produce results."""
+        """Main processing: load files, compare, produce results.
+        
+        Collects the exact blob paths written by upstream executors in the current run
+        to ensure only current-execution FetchedDetails files are validated.
+        """
+        contents = input if isinstance(input, list) else [input]
+
+        # Collect all specific FetchedDetails blob paths from current execution's content items.
+        # Each content item processed by the upstream blob output executor carries its own
+        # blob_output.blob_path in summary_data — these are the ONLY files from this run.
+        current_run_blob_paths = self._collect_current_run_fetched_paths(contents)
+
         if isinstance(input, list):
             results = []
-            for content in input:
-                results.append(await self._process_single(content))
+            for content in contents:
+                results.append(await self._process_single(content, current_run_blob_paths))
             return results
-        return await self._process_single(input)
+        return await self._process_single(contents[0], current_run_blob_paths)
 
-    async def _process_single(self, content: Content) -> Content:
+    def _collect_current_run_fetched_paths(self, contents: List[Content]) -> List[str]:
+        """Collect all FetchedDetails blob paths written by upstream executors in the current run.
+        
+        Iterates all content items and extracts their blob_output.blob_path values,
+        filtering only those that match the fetched details prefix pattern.
+        This ensures we ONLY process files from the current pipeline execution.
+        """
+        paths = []
+        for content in contents:
+            blob_path = self._resolve_nested_field(content.summary_data, self.fetched_details_path_field)
+            if blob_path and isinstance(blob_path, str):
+                filename = blob_path.split("/")[-1] if "/" in blob_path else blob_path
+                if filename.startswith(self.fetched_details_prefix) and filename.endswith(".json"):
+                    paths.append(blob_path)
+        
+        # Also check executor_logs from earlier executors in the same pipeline run
+        # that may have written multiple files (e.g., content items processed in parallel)
+        for content in contents:
+            for log in content.executor_logs:
+                if log.details and "blob_path" in log.details:
+                    bp = log.details["blob_path"]
+                    if isinstance(bp, str):
+                        filename = bp.split("/")[-1] if "/" in bp else bp
+                        if filename.startswith(self.fetched_details_prefix) and filename.endswith(".json"):
+                            if bp not in paths:
+                                paths.append(bp)
+
+        return paths
+
+    async def _process_single(self, content: Content, current_run_blob_paths: List[str]) -> Content:
         """Process a single case (folder)."""
-        await self.blob_connector.initialize()
-
-        # Determine the blob prefix for ProvidedDetails, rules, and output
-        base_prefix = self._get_base_prefix(content)
-        # Determine where FetchedDetails files are stored (may differ from base)
-        fetched_prefix = self._get_fetched_details_prefix(content)
+        start_time = datetime.now(timezone.utc)
+        content_id = content.id.canonical_id if content.id else "unknown"
+        logger.info(f"{self.id}: Starting validation for content: {content_id}")
 
-        logger.info(f"{self.id}: Base path: {base_prefix}, Fetched details path: {fetched_prefix}")
-
-        # Step 1: Load ProvidedDetails.json
-        provided_details = await self._load_json_from_blob(base_prefix, self.provided_details_filename)
-        if self.debug_mode:
-            logger.debug(f"{self.id}: Loaded ProvidedDetails with {len(provided_details.get('documents', []))} documents")
+        try:
+            # Initialize blob connector
+            init_start = datetime.now(timezone.utc)
+            await self.blob_connector.initialize()
+            if self.debug_mode:
+                init_elapsed = (datetime.now(timezone.utc) - init_start).total_seconds()
+                logger.debug(f"{self.id}: Blob connector initialized in {init_elapsed:.2f}s")
+
+            # Determine the blob prefix for ProvidedDetails, rules, and output
+            base_prefix = self._get_base_prefix(content)
+            # Determine where FetchedDetails files are stored (may differ from base)
+            fetched_prefix = self._get_fetched_details_prefix(content)
+
+            logger.info(f"{self.id}: Base path: {base_prefix}, Fetched details path: {fetched_prefix}")
+
+            # Step 1: Load ProvidedDetails.json
+            provided_details = await self._load_json_from_blob(base_prefix, self.provided_details_filename)
+            if self.debug_mode:
+                logger.debug(f"{self.id}: Loaded ProvidedDetails with {len(provided_details.get('documents', []))} documents")
+
+            # Step 2: Load rules.json
+            rules = await self._load_json_from_blob(base_prefix, self.rules_filename)
+            if self.debug_mode:
+                logger.debug(f"{self.id}: Loaded rules with {len(rules.get('rules', []))} document type rules")
+
+            # Step 3: Load FetchedDetails - prefer exact paths from current run over folder listing
+            fetched_details_list = await self._load_fetched_details_for_current_run(
+                current_run_blob_paths, fetched_prefix
+            )
+            if self.debug_mode:
+                logger.debug(f"{self.id}: Loaded {len(fetched_details_list)} fetched detail entries")
 
-        # Step 2: Load rules.json
-        rules = await self._load_json_from_blob(base_prefix, self.rules_filename)
-        if self.debug_mode:
-            logger.debug(f"{self.id}: Loaded rules with {len(rules.get('rules', []))} document type rules")
+            # Step 4: Run validation
+            results = await self._run_validation(provided_details, fetched_details_list, rules)
 
-        # Step 3: Discover and load all FetchedDetails_*.json files
-        fetched_details_list = await self._load_all_fetched_details(fetched_prefix)
-        if self.debug_mode:
-            logger.debug(f"{self.id}: Loaded {len(fetched_details_list)} fetched detail entries")
+            # Step 5: Write results.json to base path
+            await self._write_results_to_blob(base_prefix, results)
 
-        # Step 4: Run validation
-        results = await self._run_validation(provided_details, fetched_details_list, rules)
+            # Step 6: Store results in content for downstream use
+            content.data["validation_results"] = results
+            content.summary_data["validation_status"] = results.get("summary", {}).get("overallStatus", "unknown")
+            content.summary_data["executor_status"] = "success"
 
-        # Step 5: Write results.json to base path
-        await self._write_results_to_blob(base_prefix, results)
+            elapsed = (datetime.now(timezone.utc) - start_time).total_seconds()
+            logger.info(
+                f"{self.id}: Validation complete for {content_id} in {elapsed:.2f}s - "
+                f"Status: {results['summary']['overallStatus']}, "
+                f"Passed: {results['summary']['passed']}, Failed: {results['summary']['failed']}"
+            )
 
-        # Step 6: Store results in content for downstream use
-        content.data["validation_results"] = results
-        content.summary_data["validation_status"] = results.get("summary", {}).get("overallStatus", "unknown")
+            # Append executor log entry for pipeline status tracking
+            content.executor_logs.append(ExecutorLogEntry(
+                executor_id=self.id,
+                start_time=start_time,
+                end_time=datetime.now(timezone.utc),
+                status="completed",
+                details={
+                    "total_documents": results["summary"]["totalDocuments"],
+                    "passed": results["summary"]["passed"],
+                    "failed": results["summary"]["failed"],
+                },
+                errors=[]
+            ))
 
-        logger.info(
-            f"{self.id}: Validation complete - "
-            f"Status: {results['summary']['overallStatus']}, "
-            f"Passed: {results['summary']['passed']}, Failed: {results['summary']['failed']}"
-        )
+        except Exception as e:
+            elapsed = (datetime.now(timezone.utc) - start_time).total_seconds()
+            logger.error(
+                f"{self.id}: Validation failed for {content_id} after {elapsed:.2f}s: {e}",
+                exc_info=True
+            )
+            content.summary_data["executor_status"] = "failed"
+            content.executor_logs.append(ExecutorLogEntry(
+                executor_id=self.id,
+                start_time=start_time,
+                end_time=datetime.now(timezone.utc),
+                status="failed",
+                details={},
+                errors=[str(e)]
+            ))
+            raise
 
         return content
 
@@ -318,11 +403,63 @@ async def _load_json_from_blob(self, prefix: str, filename: str) -> dict:
             )
             return json.loads(content_bytes.decode("utf-8"))
         except Exception as e:
-            logger.error(f"{self.id}: Failed to load {blob_path}: {e}")
+            logger.error(f"{self.id}: Failed to load {blob_path}: {e}", exc_info=True)
             raise ValueError(f"Failed to load required file '{filename}' from {blob_path}: {e}")
 
-    async def _load_all_fetched_details(self, fetched_prefix: str) -> List[dict]:
-        """Find and load all FetchedDetails_*.json files in the fetched details path."""
+    async def _load_fetched_details_for_current_run(
+        self, current_run_blob_paths: List[str], fetched_prefix: str
+    ) -> List[dict]:
+        """Load FetchedDetails files scoped to the current pipeline execution only.
+        
+        Strategy:
+          1. If exact blob paths from the current run are available (collected from
+             upstream blob output executor's summary_data), load ONLY those specific files.
+             This guarantees no cross-run contamination.
+          2. Fallback: If no specific paths are available (e.g., manual/static config),
+             list the folder but log a warning about potential cross-run inclusion.
+        """
+        if current_run_blob_paths:
+            # PREFERRED: Load only the exact files written in this execution
+            logger.info(
+                f"{self.id}: Loading {len(current_run_blob_paths)} FetchedDetails file(s) "
+                f"from current run (exact path resolution)"
+            )
+            return await self._load_fetched_details_by_paths(current_run_blob_paths)
+        
+        # FALLBACK: No exact paths available — use folder listing with warning
+        logger.warning(
+            f"{self.id}: No exact FetchedDetails paths from current run available. "
+            f"Falling back to folder listing at '{fetched_prefix}'. "
+            f"This may include files from previous executions if the folder is shared."
+        )
+        return await self._load_all_fetched_details_from_folder(fetched_prefix)
+
+    async def _load_fetched_details_by_paths(self, blob_paths: List[str]) -> List[dict]:
+        """Load FetchedDetails from specific blob paths (current run only)."""
+        all_fetched = []
+        for blob_path in blob_paths:
+            try:
+                content_bytes = await self.blob_connector.download_blob(
+                    container_name=self.blob_container_name,
+                    blob_path=blob_path
+                )
+                fetched = json.loads(content_bytes.decode("utf-8"))
+                if isinstance(fetched, list):
+                    all_fetched.extend(fetched)
+                else:
+                    all_fetched.append(fetched)
+                if self.debug_mode:
+                    logger.debug(f"{self.id}: Loaded FetchedDetails from exact path: {blob_path}")
+            except Exception as e:
+                logger.warning(f"{self.id}: Failed to load fetched details from {blob_path}: {e}")
+        return all_fetched
+
+    async def _load_all_fetched_details_from_folder(self, fetched_prefix: str) -> List[dict]:
+        """Fallback: Find and load all FetchedDetails_*.json files in the fetched details path.
+        
+        WARNING: This may include files from previous pipeline executions if the folder
+        is shared across runs (e.g., date-based folder naming).
+        """
         all_fetched = []
         async for blobs in self.blob_connector.list_blobs(
             container_name=self.blob_container_name,
@@ -437,6 +574,15 @@ async def _run_validation(
             else:
                 results["summary"]["passed"] += 1
 
+            if self.debug_mode:
+                passed_fields = sum(1 for fr in doc_result["fieldResults"] if fr["result"] == "pass")
+                failed_fields = sum(1 for fr in doc_result["fieldResults"] if fr["result"] == "fail")
+                logger.debug(
+                    f"{self.id}: Document '{fetched_doc_type}' - "
+                    f"{len(doc_result['fieldResults'])} fields validated: "
+                    f"{passed_fields} passed, {failed_fields} failed"
+                )
+
             results["documentResults"].append(doc_result)
 
         # Set overall status
@@ -734,7 +880,10 @@ async def _ai_address_match(self, address1: str, address2: str) -> bool:
                 return "true" in lower_response or "match" in lower_response
 
         except Exception as e:
-            logger.warning(f"{self.id}: AI address match failed, falling back to string comparison: {e}")
+            logger.warning(
+                f"{self.id}: AI address match failed, falling back to string comparison: {e}",
+                exc_info=True
+            )
             return self._values_match(address1, address2)
 
     def _values_match(self, fetched: str, provided: str) -> bool:
diff --git a/contentflow-worker/app/worker/processing_worker.py b/contentflow-worker/app/worker/processing_worker.py
index c5a7b75..c639de0 100644
--- a/contentflow-worker/app/worker/processing_worker.py
+++ b/contentflow-worker/app/worker/processing_worker.py
@@ -236,6 +236,10 @@ def _execute_task(self, task: ContentProcessingTask) -> bool:
                 self._update_execution_status(execution_id=task.execution_id, status="failed", error="No input content")
                 return True
             
+            # Inject execution_id into content items for downstream executor use
+            for c in content:
+                c.summary_data["execution_id"] = task.execution_id
+            
             # Execute pipeline synchronously (using asyncio.run)
             result = self._run_pipeline(pipeline_config, content, task)
             
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index a36920a..edecbb2 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -24,6 +24,9 @@ param foundryLocation string
 @description('Location for Cosmos DB resources (override if primary region has capacity issues)')
 param cosmosLocation string = location
 
+@description('Resource ID of an existing Azure OpenAI resource for RBAC assignment (if not using AI Foundry integrated endpoint)')
+param existingOpenAIResourceId string = ''
+
 @description('ID of the user running the deployment')
 param principalId string = ''
 
@@ -486,6 +489,17 @@ module aiFoundry 'modules/ai-foundry.bicep' = {
   }
 }
 
+// ========== OPENAI RBAC ROLE ASSIGNMENT (for standalone Azure OpenAI resources) ==========
+module openaiRoleAssignment 'modules/openai-role-assignment.bicep' = if (!empty(existingOpenAIResourceId)) {
+  name: 'openai-role-${resourceToken}'
+  params: {
+    openAIResourceId: existingOpenAIResourceId
+    principalIds: !empty(principalId)
+      ? [userAssignedIdentity.outputs.principalId, principalId]
+      : [userAssignedIdentity.outputs.principalId]
+  }
+}
+
 // ========== API CONTAINER APP ==========
 module apiContainerApp 'modules/container-app.bicep' = {
   name: 'ca-api-${resourceToken}'
diff --git a/infra/bicep/main.parameters.json b/infra/bicep/main.parameters.json
index ed765b5..1db7a4c 100644
--- a/infra/bicep/main.parameters.json
+++ b/infra/bicep/main.parameters.json
@@ -17,6 +17,9 @@
     "cosmosLocation": {
       "value": "${AZURE_COSMOS_LOCATION=eastus2}"
     },
+    "existingOpenAIResourceId": {
+      "value": "${EXISTING_OPENAI_RESOURCE_ID=}"
+    },
     "principalId": {
       "value": "${AZURE_PRINCIPAL_ID}"
     },
diff --git a/infra/bicep/modules/openai-role-assignment.bicep b/infra/bicep/modules/openai-role-assignment.bicep
new file mode 100644
index 0000000..f223233
--- /dev/null
+++ b/infra/bicep/modules/openai-role-assignment.bicep
@@ -0,0 +1,31 @@
+// Assigns 'Cognitive Services OpenAI User' role to a managed identity on an existing Azure OpenAI resource.
+// This enables the managed identity to perform inference operations (chat completions, embeddings, etc.)
+// without requiring API keys — supporting Zero Trust Architecture (ZTA) compliance.
+
+@description('Resource ID of the existing Azure OpenAI / Cognitive Services resource')
+param openAIResourceId string
+
+@description('Principal IDs of the managed identities to assign the role to')
+param principalIds string[]
+
+// Cognitive Services OpenAI User - allows inference (completions, embeddings) but not management
+var roleDefinitionId = '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'
+
+// Reference the existing resource to scope the role assignment
+resource openAIResource 'Microsoft.CognitiveServices/accounts@2024-10-01' existing = {
+  name: last(split(openAIResourceId, '/'))
+  scope: resourceGroup()
+}
+
+// Create role assignments for each principal
+resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = [
+  for principalId in principalIds: {
+    name: guid(openAIResourceId, roleDefinitionId, principalId)
+    scope: openAIResource
+    properties: {
+      roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', roleDefinitionId)
+      principalId: principalId
+      principalType: 'ServicePrincipal'
+    }
+  }
+]

From ef61ee693067f71397023580d7f8ac5613b081ce Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Thu, 7 May 2026 20:48:00 +0530
Subject: [PATCH 04/28] feat: Add Content Understanding post-provision
 automation and seed assets

- Add postprovision hook to azure.yaml to run CU setup after infra provisioning
- Add seed/analyzers/details_extractor_documents_new1.json for automatic custom analyzer creation via CU REST API
- Add seed/pipelines/draft-fetched-details-pipeline.yaml with env var placeholders
- Extend post-provision.sh with CU model defaults binding and analyzer auto-discovery
- Add text-embedding-3-large model deployment to ai-foundry.bicep
---
 azure.yaml                                    |  12 +-
 .../details_extractor_documents_new1.json     | 131 +++++++++
 .../draft-fetched-details-pipeline.yaml       | 268 ++++++++++++++++++
 infra/bicep/modules/ai-foundry.bicep          |  12 +
 infra/scripts/post-provision.sh               | 109 +++++++
 5 files changed, 526 insertions(+), 6 deletions(-)
 create mode 100644 contentflow-api/seed/analyzers/details_extractor_documents_new1.json
 create mode 100644 contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml

diff --git a/azure.yaml b/azure.yaml
index 1f7e5aa..c6043c4 100644
--- a/azure.yaml
+++ b/azure.yaml
@@ -55,12 +55,12 @@ hooks:
     interactive: false
     continueOnError: false
   
-#   # Run after infrastructure is provisioned
-#   # postprovision:
-#   #   shell: sh
-#   #   run: ./infra/scripts/post-provision.sh
-#   #   interactive: false
-#   #   continueOnError: false
+  # Run after infrastructure is provisioned
+  postprovision:
+    shell: sh
+    run: ./infra/scripts/post-provision.sh
+    interactive: false
+    continueOnError: false
 
 #   # # Run before deploying all services
 #   # predeploy:
diff --git a/contentflow-api/seed/analyzers/details_extractor_documents_new1.json b/contentflow-api/seed/analyzers/details_extractor_documents_new1.json
new file mode 100644
index 0000000..60d2804
--- /dev/null
+++ b/contentflow-api/seed/analyzers/details_extractor_documents_new1.json
@@ -0,0 +1,131 @@
+{
+  "description": "to fetch details from uploaded documents",
+  "baseAnalyzerId": "prebuilt-document",
+  "models": {
+    "completion": "gpt-4.1",
+    "embedding": "text-embedding-3-large"
+  },
+  "config": {
+    "returnDetails": false,
+    "enableOcr": true,
+    "enableLayout": false,
+    "enableFormula": true,
+    "enableFigureDescription": false,
+    "enableFigureAnalysis": false,
+    "chartFormat": "chartjs",
+    "tableFormat": "html",
+    "enableSegment": false,
+    "omitContent": false,
+    "segmentPerPage": false,
+    "annotationFormat": "markdown"
+  },
+  "fieldSchema": {
+    "fields": {
+      "CountryRegion": {
+        "type": "string",
+        "method": "extract",
+        "description": "CountryRegion extracted from the document"
+      },
+      "Region": {
+        "type": "string",
+        "method": "extract",
+        "description": "Region extracted from the document"
+      },
+      "DocumentNumber": {
+        "type": "string",
+        "method": "extract",
+        "description": "DocumentNumber extracted from the document"
+      },
+      "DocumentDiscriminator": {
+        "type": "string",
+        "method": "extract",
+        "description": "DocumentDiscriminator extracted from the document"
+      },
+      "FirstName": {
+        "type": "string",
+        "method": "extract",
+        "description": "FirstName extracted from the document"
+      },
+      "LastName": {
+        "type": "string",
+        "method": "extract",
+        "description": "LastName extracted from the document"
+      },
+      "Address": {
+        "type": "string",
+        "method": "extract",
+        "description": "Address extracted from the document"
+      },
+      "BirthDate": {
+        "type": "date",
+        "method": "extract",
+        "description": "BirthDate extracted from the document"
+      },
+      "ExpirationDate": {
+        "type": "date",
+        "method": "extract",
+        "description": "ExpirationDate extracted from the document"
+      },
+      "IssueDate": {
+        "type": "date",
+        "method": "extract",
+        "description": "IssueDate extracted from the document"
+      },
+      "EyeColor": {
+        "type": "string",
+        "method": "extract",
+        "description": "EyeColor extracted from the document"
+      },
+      "HairColor": {
+        "type": "string",
+        "method": "extract",
+        "description": "HairColor extracted from the document"
+      },
+      "Height": {
+        "type": "string",
+        "method": "extract",
+        "description": "Height extracted from the document"
+      },
+      "Weight": {
+        "type": "string",
+        "method": "extract",
+        "description": "Weight extracted from the document"
+      },
+      "Sex": {
+        "type": "string",
+        "method": "extract",
+        "description": "Sex extracted from the document"
+      },
+      "Endorsements": {
+        "type": "string",
+        "method": "extract",
+        "description": "Endorsements extracted from the document"
+      },
+      "Restrictions": {
+        "type": "string",
+        "method": "extract",
+        "description": "Restrictions extracted from the document"
+      },
+      "PersonalNumber": {
+        "type": "string",
+        "method": "extract",
+        "description": "PersonalNumber extracted from the document"
+      },
+      "PlaceOfBirth": {
+        "type": "string",
+        "method": "extract",
+        "description": "PlaceOfBirth extracted from the document"
+      },
+      "VehicleClass": {
+        "type": "string",
+        "method": "extract",
+        "description": "VehicleClass extracted from the document"
+      },
+      "Category": {
+        "type": "string",
+        "method": "extract",
+        "description": "Category extracted from the document"
+      }
+    }
+  }
+}
diff --git a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
new file mode 100644
index 0000000..2d8d68f
--- /dev/null
+++ b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
@@ -0,0 +1,268 @@
+pipeline:
+  name: Draft Fetched Details
+  description: Processes documents from blob folder, classifies types, extracts details, outputs fetched_details.json
+  executors:
+    - id: azure_blob_input_discovery-1777658905426
+      name: Discover Input Files
+      type: azure_blob_input_discovery
+      position:
+        x: 405
+        'y': 61
+      description: >-
+        Discovers and lists content files from Azure Blob Storage containers. Must be used with an Azure Blob Content
+        Retriever executor to fetch the actual content.
+      settings:
+        enabled: true
+        condition: ''
+        fail_pipeline_on_error: true
+        debug_mode: true
+        blob_storage_account: ${AZURE_STORAGE_ACCOUNT_NAME}
+        blob_storage_credential_type: default_azure_credential
+        blob_storage_account_key: ''
+        blob_container_name: content
+        discover_mode: files
+        prefix_from_input_field: ''
+        prefix: inputs/
+        file_extensions: .pdf,.docx,.pptx,.xlsx,.png,.jpg,.jpeg,.tiff
+        max_depth: 1
+        max_results: 5
+        batch_size: 10
+        include_metadata: true
+        sort_by: name
+        sort_ascending: true
+        min_size_bytes: 0
+        max_size_bytes: 0
+        polling_interval_seconds: 300
+        modified_after: ''
+        modified_before: ''
+    - id: azure_blob_content_retriever-1777658985345
+      name: Retrieve File Content
+      type: azure_blob_content_retriever
+      position:
+        x: 405
+        'y': 216
+      description: Retrieves document content from azure blob sources. Must be used after an Azure Blob Input Discovery executor.
+      settings:
+        enabled: true
+        condition: ''
+        fail_pipeline_on_error: true
+        debug_mode: true
+        include_content_bytes_as_field: false
+        use_temp_file_for_content: true
+        temp_folder: ./tmp/contentflow
+        max_concurrent: 3
+        timeout_secs: 300
+        continue_on_error: true
+    - id: azure_content_understanding_extractor-1777662467773
+      name: Extract Document type
+      type: azure_content_understanding_extractor
+      position:
+        x: 402
+        'y': 372
+      description: Extracts content from documents using Azure AI Content Understanding with 70+ prebuilt analyzers
+      settings:
+        enabled: true
+        condition: ''
+        fail_pipeline_on_error: true
+        debug_mode: true
+        content_field: ''
+        temp_file_path_field: temp_file_path
+        output_field: content_understanding_result
+        analyzer_id: prebuilt-read
+        retrieve_figures: false
+        figures_output_field: figures
+        content_understanding_endpoint: ${AZURE_CONTENT_UNDERSTANDING_ENDPOINT}
+        content_understanding_credential_type: default_azure_credential
+        content_understanding_subscription_key: ''
+        content_understanding_api_version: '2025-11-01'
+        content_understanding_timeout: 60
+        content_understanding_polling_interval: 2
+        content_understanding_max_retries: 3
+        content_understanding_retry_backoff_factor: 2
+        content_understanding_model_mappings: '{}'
+        max_concurrent: 3
+        continue_on_error: false
+    - id: content_classifier-1777659569769
+      name: Classify Document Type
+      type: content_classifier
+      position:
+        x: 403
+        'y': 541
+      description: Classify text into predefined categories with confidence scores
+      settings:
+        enabled: true
+        condition: ''
+        fail_pipeline_on_error: true
+        debug_mode: true
+        categories: >-
+          {"Driving License": "Driver's license, driving permit, or DL issued by government", "Passport": "International
+          travel passport document", "Water Utility bill": "Water service bill or statement", "Power Utility bill":
+          "Electricity or power service bill", "Telecom Utility bill": "Phone, internet, or telecom service bill", "Real
+          ID": "Real ID": "REAL ID compliant identification card, REAL ID driver's license, or federally compliant
+          government ID with star marking issued under the REAL ID Act", "Unrecognized": "Document does not match any of
+          the above categories"}
+        multi_label: false
+        include_confidence: true
+        category_descriptions: ''
+        min_confidence: 0
+        include_explanation: true
+        endpoint: ${AZURE_OPENAI_ENDPOINT}
+        deployment_name: gpt-4.1
+        credential_type: default_azure_credential
+        api_key: ''
+        input_field: content_understanding_result
+        output_field: classification
+        include_full_response: false
+        temperature: 0
+        max_tokens: 600
+        max_retries: 3
+        retry_backoff_seconds: 1
+        max_concurrent: 3
+        timeout_secs: 300
+        continue_on_error: true
+    - id: azure_content_understanding_extractor-1777660571122
+      name: Extract Document Details
+      type: azure_content_understanding_extractor
+      position:
+        x: 407
+        'y': 698
+      description: Extracts content from documents using Azure AI Content Understanding with 70+ prebuilt analyzers
+      settings:
+        enabled: true
+        condition: classification.category != 'Unrecognized'
+        fail_pipeline_on_error: true
+        debug_mode: true
+        content_field: ''
+        temp_file_path_field: temp_file_path
+        output_field: extracted_details
+        analyzer_id: details_extractor_documents_new1
+        retrieve_figures: false
+        figures_output_field: figures
+        content_understanding_endpoint: ${AZURE_CONTENT_UNDERSTANDING_ENDPOINT}
+        content_understanding_credential_type: default_azure_credential
+        content_understanding_subscription_key: ''
+        content_understanding_api_version: '2025-11-01'
+        content_understanding_timeout: 60
+        content_understanding_polling_interval: 2
+        content_understanding_max_retries: 3
+        content_understanding_retry_backoff_factor: 2
+        content_understanding_model_mappings: '{}'
+        max_concurrent: 3
+        continue_on_error: false
+    - id: field_mapper-1777661225834
+      name: Shape Document Record
+      type: field_mapper
+      position:
+        x: 399
+        'y': 856
+      description: Rename, move, and remap fields within Content items for standardization and compatibility
+      settings:
+        enabled: true
+        condition: ''
+        fail_pipeline_on_error: true
+        debug_mode: true
+        mappings: ''
+        object_mappings: |-
+          {
+            "document_record": {
+              "document_id": "id.canonical_id",
+              "filename": "id.filename",
+              "document_type": "classification.category",
+              "confidence": "classification.confidence",
+              "details": "extracted_details"
+            }
+          }
+        source_id_mappings: ''
+        copy_mode: copy
+        create_nested: true
+        overwrite_existing: true
+        template_fields: true
+        nested_delimiter: .
+        list_handling: merge
+        join_separator: |+
+
+        merge_filter_empty: true
+        merge_deduplicate: false
+        case_transform: ''
+        fail_on_missing_source: false
+        remove_empty_objects: false
+    - id: azure_blob_output-1777661894683
+      name: Write Fetched Details
+      type: azure_blob_output
+      position:
+        x: 402
+        'y': 1000
+      description: Write content entries as JSON files to Azure Blob Storage
+      settings:
+        enabled: true
+        condition: ''
+        fail_pipeline_on_error: true
+        debug_mode: true
+        storage_account_name: ${AZURE_STORAGE_ACCOUNT_NAME}
+        credential_type: default_azure_credential
+        credential_key: ''
+        container_name: content
+        path_template: 'Fetched_Details/exec_{execution_id}_{timestamp}/'
+        filename_template: 'FetchedDetails_{id.unique_id}_{timestamp}.json'
+        content_field: document_record
+        metadata_fields: ''
+        compression: ''
+        overwrite_existing: true
+        add_timestamp: true
+        pretty_print: true
+        max_concurrent: 3
+        timeout_secs: 60
+        continue_on_error: true
+    - id: document_validation-1777725315940
+      name: Document Validation
+      type: document_validation
+      position:
+        x: 406
+        'y': 1162
+      description: >-
+        Validates fetched document details against provided details using configurable rules. Supports exact match, date
+        match, expiry check, name match, and AI-powered address matching.
+      settings:
+        enabled: true
+        fail_pipeline_on_error: true
+        debug_mode: true
+        blob_storage_account: ${AZURE_STORAGE_ACCOUNT_NAME}
+        blob_container_name: content
+        blob_storage_credential_type: default_azure_credential
+        blob_storage_account_key: ''
+        provided_details_filename: ProvidedDetails.json
+        rules_filename: rules.json
+        fetched_details_prefix: FetchedDetails_
+        output_filename: results.json
+        base_path: inputs
+        fetched_details_path: ''
+        fetched_details_path_field: blob_output.blob_path
+        case_sensitive_comparison: false
+        input_prefix_field: blob_path
+        endpoint: ${AZURE_OPENAI_ENDPOINT}
+        deployment_name: ''
+        credential_type: default_azure_credential
+        api_key: ''
+        temperature: 0.1
+  edges:
+    - from: azure_blob_input_discovery-1777658905426
+      to: azure_blob_content_retriever-1777658985345
+      type: sequential
+    - from: azure_blob_content_retriever-1777658985345
+      to: azure_content_understanding_extractor-1777662467773
+      type: sequential
+    - from: azure_content_understanding_extractor-1777662467773
+      to: content_classifier-1777659569769
+      type: sequential
+    - from: content_classifier-1777659569769
+      to: azure_content_understanding_extractor-1777660571122
+      type: sequential
+    - from: azure_content_understanding_extractor-1777660571122
+      to: field_mapper-1777661225834
+      type: sequential
+    - from: field_mapper-1777661225834
+      to: azure_blob_output-1777661894683
+      type: sequential
+    - from: azure_blob_output-1777661894683
+      to: document_validation-1777725315940
+      type: sequential
diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep
index aaae5ea..8fdb66c 100644
--- a/infra/bicep/modules/ai-foundry.bicep
+++ b/infra/bicep/modules/ai-foundry.bicep
@@ -65,6 +65,18 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
           name: 'GlobalStandard'
         }
       }
+      {
+        model: {
+          format: 'OpenAI'
+          name: 'text-embedding-3-large'
+          version: '1'
+        }
+        name: 'text-embedding-3-large'
+        sku: {
+          capacity: 100
+          name: 'Standard'
+        }
+      }
     ]
     // aiSearchConfiguration: {
     //   name: '<name>'
diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index 96281c0..fabbc7f 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -25,6 +25,115 @@ az storage queue create \
   --auth-mode login \
   --only-show-errors || echo "Queue already exists or error creating queue"
 
+# ========== CONTENT UNDERSTANDING SETUP ==========
+echo ""
+echo "=================================================="
+echo "Content Understanding - Model Defaults & Analyzers"
+echo "=================================================="
+
+# Resolve AI Services endpoint from Bicep output
+AI_SERVICES_NAME=$(azd env get-value AI_SERVICES_NAME 2>/dev/null || echo "")
+
+if [ -z "$AI_SERVICES_NAME" ]; then
+    echo "⚠️  AI_SERVICES_NAME not found in azd env. Skipping CU setup."
+    echo "   Set AI_SERVICES_NAME manually and re-run if needed."
+else
+    # Construct CU endpoint from AI Services account name
+    CU_ENDPOINT="https://${AI_SERVICES_NAME}.services.ai.azure.com"
+    CU_API_VERSION="2025-11-01"
+    echo "CU Endpoint: $CU_ENDPOINT"
+
+    # Obtain a bearer token for Cognitive Services scope
+    echo "Acquiring access token..."
+    ACCESS_TOKEN=$(az account get-access-token \
+        --resource "https://cognitiveservices.azure.com" \
+        --query accessToken -o tsv 2>/dev/null || echo "")
+
+    if [ -z "$ACCESS_TOKEN" ]; then
+        echo "⚠️  Failed to acquire access token. Skipping CU setup."
+        echo "   Ensure the deployer identity has 'Cognitive Services User' role."
+    else
+        # --- Step 1: Set default model deployments ---
+        echo ""
+        echo "[CU-1] Setting default model deployments..."
+        CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
+            "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
+            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+            -H "Content-Type: application/merge-patch+json" \
+            -d '{
+                "modelDeployments": {
+                    "gpt-4.1": "gpt-4.1",
+                    "gpt-4.1-mini": "gpt-4.1-mini",
+                    "text-embedding-3-large": "text-embedding-3-large"
+                }
+            }' 2>/dev/null)
+
+        CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
+        CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
+
+        if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+            echo "  ✅ Default model deployments configured successfully"
+        else
+            echo "  ⚠️  Failed to set CU defaults (HTTP $CU_DEFAULTS_HTTP_CODE)"
+            echo "     Response: $CU_DEFAULTS_BODY"
+            echo "     Model deployments may not be available yet. Run post-provision again after models are ready."
+        fi
+
+        # --- Step 2: Create/update custom analyzers from seed folder ---
+        echo ""
+        echo "[CU-2] Creating custom analyzers from seed definitions..."
+
+        SEED_DIR="$(cd "$(dirname "$0")/../.." && pwd)/contentflow-api/seed/analyzers"
+
+        if [ ! -d "$SEED_DIR" ]; then
+            echo "  ℹ️  No seed/analyzers folder found at: $SEED_DIR"
+            echo "     Skipping custom analyzer creation."
+        else
+            ANALYZER_COUNT=0
+            ANALYZER_SUCCESS=0
+            ANALYZER_FAILED=0
+
+            for ANALYZER_FILE in "$SEED_DIR"/*.json; do
+                # Skip if no JSON files exist (glob returns literal pattern)
+                [ -e "$ANALYZER_FILE" ] || continue
+
+                ANALYZER_COUNT=$((ANALYZER_COUNT + 1))
+                # Derive analyzer ID from filename (e.g., details_extractor_documents_new1.json -> details_extractor_documents_new1)
+                ANALYZER_ID=$(basename "$ANALYZER_FILE" .json)
+
+                echo "  Creating analyzer: $ANALYZER_ID ..."
+
+                # PUT is create-or-replace (idempotent)
+                ANALYZER_RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT \
+                    "${CU_ENDPOINT}/contentunderstanding/analyzers/${ANALYZER_ID}?api-version=${CU_API_VERSION}" \
+                    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                    -H "Content-Type: application/json" \
+                    -d @"$ANALYZER_FILE" 2>/dev/null)
+
+                ANALYZER_HTTP_CODE=$(echo "$ANALYZER_RESPONSE" | tail -1)
+                ANALYZER_BODY=$(echo "$ANALYZER_RESPONSE" | sed '$d')
+
+                if [ "$ANALYZER_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$ANALYZER_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+                    echo "    ✅ $ANALYZER_ID — created/updated (HTTP $ANALYZER_HTTP_CODE)"
+                    ANALYZER_SUCCESS=$((ANALYZER_SUCCESS + 1))
+                else
+                    echo "    ❌ $ANALYZER_ID — failed (HTTP $ANALYZER_HTTP_CODE)"
+                    echo "       Response: $ANALYZER_BODY"
+                    ANALYZER_FAILED=$((ANALYZER_FAILED + 1))
+                fi
+            done
+
+            if [ "$ANALYZER_COUNT" -eq 0 ]; then
+                echo "  ℹ️  No analyzer JSON files found in seed/analyzers/"
+            else
+                echo ""
+                echo "  Analyzers processed: $ANALYZER_COUNT (✅ $ANALYZER_SUCCESS succeeded, ❌ $ANALYZER_FAILED failed)"
+            fi
+        fi
+    fi
+fi
+
+echo ""
 echo "=================================================="
 echo "✓ Post-provision completed successfully"
 echo "=================================================="

From 40a37e2cd2a943919f2731c1949b51050482aa71 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Tue, 12 May 2026 17:29:16 +0000
Subject: [PATCH 05/28] fix(infra): resolve AILZ deployment issues for
 container apps and private networking

- Fix container app ingress port: use targetPort instead of hardcoded port 80
- Fix container app ingress scope: set externalIngress to true (VNet-scoped on internal CAE)
- Add pipeline executor env vars to API and Worker container apps
- Add queue private DNS zone auto-creation for AILZ mode (new module: queue-dns-zone.bicep)
- Fix Cosmos DB default location from eastus2 to eastus
- Fix seed pipeline blob prefix mismatch: inputs/ -> input/
---
 .../draft-fetched-details-pipeline.yaml       |  4 +-
 infra/bicep/main.bicep                        | 49 +++++++++++++++++--
 infra/bicep/main.parameters.json              |  2 +-
 infra/bicep/modules/container-app.bicep       |  3 +-
 infra/bicep/modules/queue-dns-zone.bicep      | 32 ++++++++++++
 5 files changed, 81 insertions(+), 9 deletions(-)
 create mode 100644 infra/bicep/modules/queue-dns-zone.bicep

diff --git a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
index 2d8d68f..abd88f4 100644
--- a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
+++ b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
@@ -22,7 +22,7 @@ pipeline:
         blob_container_name: content
         discover_mode: files
         prefix_from_input_field: ''
-        prefix: inputs/
+        prefix: input/
         file_extensions: .pdf,.docx,.pptx,.xlsx,.png,.jpg,.jpeg,.tiff
         max_depth: 1
         max_results: 5
@@ -234,7 +234,7 @@ pipeline:
         rules_filename: rules.json
         fetched_details_prefix: FetchedDetails_
         output_filename: results.json
-        base_path: inputs
+        base_path: input
         fetched_details_path: ''
         fetched_details_path_field: blob_output.blob_path
         case_sensitive_comparison: false
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index f9c1e86..efd4750 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -214,6 +214,23 @@ var appInsightsConnectionString = !empty(existingAppInsightsId)
   : (shouldCreateAppInsights ? appInsights!.outputs.connectionString : '')
 
 
+// ========== QUEUE PRIVATE DNS ZONE (AILZ mode, auto-create if not provided) ==========
+// When no existing queue DNS zone is provided, create one so the storage queue
+// private endpoint can resolve via private IP within the VNet
+var shouldCreateQueueDnsZone = isAILZIntegrated && empty(existingQueuePrivateDnsZoneId)
+
+module queueDnsZone 'modules/queue-dns-zone.bicep' = if (shouldCreateQueueDnsZone) {
+  name: 'queue-dns-${resourceToken}'
+  params: {
+    vnetResourceId: existingVnetResourceId
+    tags: tags
+  }
+}
+
+var resolvedQueueDnsZoneId = isAILZIntegrated
+  ? (!empty(existingQueuePrivateDnsZoneId) ? existingQueuePrivateDnsZoneId : (shouldCreateQueueDnsZone ? queueDnsZone.outputs.dnsZoneId : ''))
+  : ''
+
 // ========== STORAGE ACCOUNT  ==========
 // Create new Storage Account, with private endpoint support (if using AILZ integrated mode), 
 // or use public endpoints (basic mode)
@@ -228,7 +245,7 @@ module storage 'modules/storage.bicep' = {
     enablePrivateEndpoint: isAILZIntegrated
     privateEndpointSubnetId: isAILZIntegrated ? networkConfig.privateEndpointSubnetId : ''
     blobPrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.blob : ''
-    queuePrivateDnsZoneId: isAILZIntegrated ? networkConfig.privateDnsZoneIds.queue : ''
+    queuePrivateDnsZoneId: resolvedQueueDnsZoneId
     publicNetworkAccess: isAILZIntegrated ? 'Disabled' : 'Enabled'
     logAnalyticsWorkspaceId: logAnalyticsWorkspaceId
     tags: tags
@@ -524,7 +541,7 @@ module apiContainerApp 'modules/container-app.bicep' = {
     containerRegistryServer: containerRegistry!.outputs.loginServer
     managedIdentityId: userAssignedIdentity.outputs.resourceId
     targetPort: 8090
-    externalIngress: !isAILZIntegrated
+    externalIngress: true
     corsEnabled: true
     livenessProbePath: '' // Disabled for initial provisioning with placeholder image
     cpuCores: 2
@@ -548,6 +565,18 @@ module apiContainerApp 'modules/container-app.bicep' = {
         name: 'WORKER_ENGINE_API_ENDPOINT'
         value: 'https://${workerContainerApp.outputs.fqdn}'
       }
+      {
+        name: 'AZURE_STORAGE_ACCOUNT_NAME'
+        value: storageAccountName
+      }
+      {
+        name: 'AZURE_CONTENT_UNDERSTANDING_ENDPOINT'
+        value: 'https://${aiFoundry.outputs.aiServicesName}.services.ai.azure.com'
+      }
+      {
+        name: 'AZURE_OPENAI_ENDPOINT'
+        value: 'https://${aiFoundry.outputs.aiServicesName}.services.ai.azure.com'
+      }
     ]
     tags: union(tags, { 'azd-service-name': 'api' })
   }
@@ -563,7 +592,7 @@ module workerContainerApp 'modules/container-app.bicep' = {
     containerRegistryServer: containerRegistry!.outputs.loginServer
     managedIdentityId: userAssignedIdentity.outputs.resourceId
     targetPort: workerContainerAppTargetPort
-    externalIngress: !isAILZIntegrated
+    externalIngress: true
     corsEnabled: true
     livenessProbePath: '' // Disabled for initial provisioning with placeholder image
     cpuCores: 2
@@ -583,6 +612,18 @@ module workerContainerApp 'modules/container-app.bicep' = {
         name: 'AZURE_CLIENT_ID'
         value: userAssignedIdentity.outputs.clientId
       }
+      {
+        name: 'AZURE_STORAGE_ACCOUNT_NAME'
+        value: storageAccountName
+      }
+      {
+        name: 'AZURE_CONTENT_UNDERSTANDING_ENDPOINT'
+        value: 'https://${aiFoundry.outputs.aiServicesName}.services.ai.azure.com'
+      }
+      {
+        name: 'AZURE_OPENAI_ENDPOINT'
+        value: 'https://${aiFoundry.outputs.aiServicesName}.services.ai.azure.com'
+      }
     ]
     tags: union(tags, { 'azd-service-name': 'worker' })
   }
@@ -598,7 +639,7 @@ module webContainerApp 'modules/container-app.bicep' = {
     containerRegistryServer: containerRegistry!.outputs.loginServer
     managedIdentityId: userAssignedIdentity.outputs.resourceId
     targetPort: 8080
-    externalIngress: !isAILZIntegrated
+    externalIngress: true
     corsEnabled: true
     livenessProbePath: '' // Disabled for initial provisioning with placeholder image
     cpuCores: 1
diff --git a/infra/bicep/main.parameters.json b/infra/bicep/main.parameters.json
index 618fe8d..d9db415 100644
--- a/infra/bicep/main.parameters.json
+++ b/infra/bicep/main.parameters.json
@@ -15,7 +15,7 @@
       "value": "${AZURE_AI_FOUNDRY_LOCATION}"
     },
     "cosmosLocation": {
-      "value": "${AZURE_COSMOS_LOCATION=eastus2}"
+      "value": "${AZURE_COSMOS_LOCATION=eastus}"
     },
     "existingOpenAIResourceId": {
       "value": "${EXISTING_OPENAI_RESOURCE_ID=}"
diff --git a/infra/bicep/modules/container-app.bicep b/infra/bicep/modules/container-app.bicep
index c98a9e5..5f4af16 100644
--- a/infra/bicep/modules/container-app.bicep
+++ b/infra/bicep/modules/container-app.bicep
@@ -91,8 +91,7 @@ module containerApp 'br:mcr.microsoft.com/bicep/avm/res/app/container-app:0.19.0
     ]
     ingressAllowInsecure: false
     ingressExternal: externalIngress
-    // Use port 80 to match placeholder image; azd deploy will update to targetPort with real image
-    ingressTargetPort: 80
+    ingressTargetPort: targetPort
     ingressTransport: 'auto'
     activeRevisionsMode: 'Single'
     managedIdentities: {
diff --git a/infra/bicep/modules/queue-dns-zone.bicep b/infra/bicep/modules/queue-dns-zone.bicep
new file mode 100644
index 0000000..eea8847
--- /dev/null
+++ b/infra/bicep/modules/queue-dns-zone.bicep
@@ -0,0 +1,32 @@
+// Queue Private DNS Zone Module
+// Creates privatelink.queue.core.windows.net DNS zone and links it to the VNet
+// Used when no existing queue DNS zone is provided in AILZ mode
+
+@description('Resource ID of the VNet to link the DNS zone to')
+param vnetResourceId string
+
+@description('Tags for resources')
+param tags object = {}
+
+// Create the private DNS zone for Azure Storage Queue
+resource privateDnsZone 'Microsoft.Network/privateDnsZones@2024-06-01' = {
+  name: 'privatelink.queue.core.windows.net'
+  location: 'global'
+  tags: tags
+}
+
+// Link the DNS zone to the VNet so containers can resolve queue endpoints via private IP
+resource vnetLink 'Microsoft.Network/privateDnsZones/virtualNetworkLinks@2024-06-01' = {
+  parent: privateDnsZone
+  name: '${last(split(vnetResourceId, '/'))}-queue-link'
+  location: 'global'
+  tags: tags
+  properties: {
+    virtualNetwork: {
+      id: vnetResourceId
+    }
+    registrationEnabled: false
+  }
+}
+
+output dnsZoneId string = privateDnsZone.id

From a8aca5353749f68d3b5d344e5ffa7b3428b8f811 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Wed, 13 May 2026 20:17:24 +0000
Subject: [PATCH 06/28] feat: add multipart ingest API, fix document validation
 executor, add pipeline auto-seeding

- Add POST /api/ingest endpoint for multipart document submission
- Add IngestPayload/IngestResponse models, IngestService, ingest router
- Fix document_validation_executor: flat ProvidedDetails format support,
  rules_base_path direct settings read, parent dir extraction from content.id.path,
  cleanup moved to process_input to prevent premature file deletion
- Fix ProvidedDetails field names to PascalCase matching rules.json/FetchedDetails
- Propagate parent content data in azure_blob_input_discovery to child items
- Add rules_base_path, cleanup_input_after_results, cleanup_preserve_files
  settings to executor_catalog.yaml (version bump 1.2 -> 1.3)
- Add pipeline auto-seeding from seed/pipelines/ on startup
- Add test_ingest_api.py for integration testing
- Add temp-venv to .gitignore
---
 .gitignore                                    |   1 +
 contentflow-api/app/dependencies.py           |  86 ++++++
 contentflow-api/app/models/__init__.py        |   3 +
 contentflow-api/app/models/_ingest.py         |  30 ++
 contentflow-api/app/routers/__init__.py       |   2 +
 contentflow-api/app/routers/ingest.py         | 186 +++++++++++++
 .../app/services/ingest_service.py            | 119 ++++++++
 .../services/pipeline_execution_service.py    |  27 +-
 contentflow-api/app/settings.py               |   9 +
 contentflow-api/app/startup.py                |   3 +-
 contentflow-api/main.py                       |   3 +-
 .../draft-fetched-details-pipeline.yaml       |  25 +-
 contentflow-api/seed/test_ingest_api.py       | 257 ++++++++++++++++++
 .../executors/azure_blob_input_discovery.py   |   8 +
 .../executors/document_validation_executor.py | 111 +++++++-
 contentflow-lib/executor_catalog.yaml         |  27 +-
 16 files changed, 872 insertions(+), 25 deletions(-)
 create mode 100644 contentflow-api/app/models/_ingest.py
 create mode 100644 contentflow-api/app/routers/ingest.py
 create mode 100644 contentflow-api/app/services/ingest_service.py
 create mode 100644 contentflow-api/seed/test_ingest_api.py

diff --git a/.gitignore b/.gitignore
index 6e1d706..28df913 100644
--- a/.gitignore
+++ b/.gitignore
@@ -139,6 +139,7 @@ celerybeat.pid
 .venv
 env/
 venv/
+temp-venv/
 ENV/
 env.bak/
 venv.bak/
diff --git a/contentflow-api/app/dependencies.py b/contentflow-api/app/dependencies.py
index 898672f..e82be60 100644
--- a/contentflow-api/app/dependencies.py
+++ b/contentflow-api/app/dependencies.py
@@ -20,6 +20,7 @@
 
 
 EXECUTOR_CATALOG_FILE_PATH = f'{Path(__file__).parent.parent.parent}/contentflow-lib/executor_catalog.yaml'
+SEED_PIPELINES_DIR = f'{Path(__file__).parent.parent}/seed/pipelines'
 
 def get_config_provider(refresh: bool = False) -> ConfigurationProvider:
     """Get a singleton instance of ConfigurationProvider"""
@@ -89,6 +90,20 @@ async def get_pipeline_execution_service():
     from app.services.pipeline_execution_service import PipelineExecutionService
     return PipelineExecutionService(await get_cosmos_client())
 
+
+async def get_ingest_service():
+    """Dependency to get IngestService (uses global blob storage singleton)"""
+    from app.settings import get_settings
+    from app.utils.blob_storage import get_blob_storage_service
+    from app.services.ingest_service import IngestService
+
+    app_settings = get_settings()
+    blob_service = await get_blob_storage_service(
+        account_name=app_settings.BLOB_STORAGE_ACCOUNT_NAME,
+        container_name=app_settings.BLOB_STORAGE_CONTAINER_NAME,
+    )
+    return IngestService(blob_service)
+
 async def initialize_executor_catalog():
     """Initialize executor catalog"""
     logger.info(f"{'>'*70}")
@@ -158,6 +173,77 @@ async def initialize_blob_storage():
         logger.exception(e)
         raise
 
+async def initialize_seed_pipelines():
+    """Seed pipelines from YAML files in seed/pipelines/ on startup.
+    
+    For each YAML file, checks if a pipeline with the same name already exists.
+    If not, creates it. If it already exists, skips it.
+    """
+    import yaml
+    import glob
+
+    logger.info(f"{'>'*70}")
+    logger.info("contentflow.api: Seeding pipelines from seed/pipelines/...")
+    logger.info(f"{'-'*70}")
+    try:
+        pipeline_service = await get_pipeline_service()
+        seed_dir = str(SEED_PIPELINES_DIR)
+        yaml_files = glob.glob(f"{seed_dir}/*.yaml") + glob.glob(f"{seed_dir}/*.yml")
+
+        if not yaml_files:
+            logger.info("No pipeline YAML files found in seed/pipelines/. Skipping.")
+            logger.info(f"{'<'*70}")
+            return True
+
+        created = 0
+        skipped = 0
+        for yaml_path in yaml_files:
+            try:
+                with open(yaml_path, "r") as f:
+                    raw = yaml.safe_load(f)
+
+                pipeline_def = raw.get("pipeline", raw)
+                name = pipeline_def.get("name")
+                if not name:
+                    logger.warning(f"Skipping {yaml_path}: no 'name' field found.")
+                    continue
+
+                # Check if already exists
+                existing = await pipeline_service.get_pipeline_by_name(name)
+                if existing:
+                    logger.info(f"  Pipeline '{name}' already exists (id={existing.id}). Skipping.")
+                    skipped += 1
+                    continue
+
+                # Build the full YAML string for storage
+                with open(yaml_path, "r") as f:
+                    yaml_str = f.read()
+
+                pipeline_data = {
+                    "name": name,
+                    "description": pipeline_def.get("description", ""),
+                    "yaml": yaml_str,
+                    "nodes": [],
+                    "edges": pipeline_def.get("edges", []),
+                    "tags": pipeline_def.get("tags", []),
+                    "enabled": True,
+                }
+
+                result = await pipeline_service.create_pipeline(pipeline_data)
+                logger.info(f"  Created pipeline '{name}' with id={result.id}")
+                created += 1
+
+            except Exception as e:
+                logger.warning(f"  Failed to seed pipeline from {yaml_path}: {e}")
+
+        logger.info(f"Pipeline seeding complete: {created} created, {skipped} skipped.")
+        logger.info(f"{'<'*70}")
+        return True
+    except Exception as e:
+        logger.error(f"Error during pipeline seeding: {str(e)}")
+        logger.exception(e)
+        raise
+
 async def close_all():
     """Close all dependencies"""
     global __cosmos_client
diff --git a/contentflow-api/app/models/__init__.py b/contentflow-api/app/models/__init__.py
index 508b1ce..3041371 100644
--- a/contentflow-api/app/models/__init__.py
+++ b/contentflow-api/app/models/__init__.py
@@ -17,6 +17,7 @@
     VaultExecution,
     VaultCrawlCheckpoint,
 )
+from ._ingest import IngestPayload, IngestResponse
 
 try:
     __version__ = importlib.metadata.version(__name__)
@@ -39,4 +40,6 @@
             "VaultUpdateRequest",
             "VaultExecution",
             "VaultCrawlCheckpoint",
+            "IngestPayload",
+            "IngestResponse",
           ]
\ No newline at end of file
diff --git a/contentflow-api/app/models/_ingest.py b/contentflow-api/app/models/_ingest.py
new file mode 100644
index 0000000..2d5663c
--- /dev/null
+++ b/contentflow-api/app/models/_ingest.py
@@ -0,0 +1,30 @@
+"""
+Ingest API models for multipart document submission.
+"""
+from typing import Optional
+from pydantic import BaseModel
+
+
+class IngestPayload(BaseModel):
+    """Form fields submitted by the client that become ProvidedDetails.json"""
+    caseId: str
+    firstName: str
+    lastName: str
+    mailingAddress: str
+    dateOfBirth: str
+    dateOfDeath: Optional[str] = ""
+    fatherFirstName: Optional[str] = ""
+    fatherLastName: Optional[str] = ""
+    motherFirstName: Optional[str] = ""
+    motherLastName: Optional[str] = ""
+
+
+class IngestResponse(BaseModel):
+    """Response returned to client on successful ingest (202 Accepted)"""
+    execution_id: str
+    case_id: str
+    status: str
+    files_uploaded: int
+    blob_prefix: str
+    pipeline_id: str
+    pipeline_name: str
diff --git a/contentflow-api/app/routers/__init__.py b/contentflow-api/app/routers/__init__.py
index da1967a..97611d0 100644
--- a/contentflow-api/app/routers/__init__.py
+++ b/contentflow-api/app/routers/__init__.py
@@ -4,6 +4,7 @@
 from .pipelines import router as pipelines_router
 from .executors import router as executors_router
 from .vaults import router as vaults_router
+from .ingest import router as ingest_router
 
 try:
     __version__ = importlib.metadata.version(__name__)
@@ -15,4 +16,5 @@
             "pipelines_router",
             "executors_router",
             "vaults_router",
+            "ingest_router",
           ]
\ No newline at end of file
diff --git a/contentflow-api/app/routers/ingest.py b/contentflow-api/app/routers/ingest.py
new file mode 100644
index 0000000..760b4a8
--- /dev/null
+++ b/contentflow-api/app/routers/ingest.py
@@ -0,0 +1,186 @@
+"""
+Ingest router for multipart document submission API.
+"""
+import logging
+import os
+from typing import List, Optional
+
+from fastapi import APIRouter, BackgroundTasks, Depends, File, Form, HTTPException, UploadFile
+
+from app.models import IngestPayload, IngestResponse, ExecutionStatus
+from app.services.pipeline_service import PipelineService
+from app.services.pipeline_execution_service import PipelineExecutionService
+from app.services.ingest_service import IngestService
+from app.dependencies import (
+    get_pipeline_service,
+    get_pipeline_execution_service,
+    get_ingest_service,
+)
+from app.settings import get_settings
+
+logger = logging.getLogger("contentflow.api.routers.ingest")
+
+router = APIRouter(prefix="/ingest", tags=["ingest"])
+
+
+@router.post("/", response_model=IngestResponse, status_code=202)
+async def ingest_documents(
+    background_tasks: BackgroundTasks,
+    # Payload fields
+    case_id: str = Form(..., alias="caseId", description="Client's unique case identifier"),
+    first_name: str = Form(..., alias="firstName"),
+    last_name: str = Form(..., alias="lastName"),
+    mailing_address: str = Form(..., alias="mailingAddress"),
+    date_of_birth: str = Form(..., alias="dateOfBirth"),
+    date_of_death: Optional[str] = Form("", alias="dateOfDeath"),
+    father_first_name: Optional[str] = Form("", alias="fatherFirstName"),
+    father_last_name: Optional[str] = Form("", alias="fatherLastName"),
+    mother_first_name: Optional[str] = Form("", alias="motherFirstName"),
+    mother_last_name: Optional[str] = Form("", alias="motherLastName"),
+    # Pipeline
+    pipeline_id: str = Form(..., description="Pipeline ID to execute"),
+    # Files
+    files: List[UploadFile] = File(..., description="Document files to process"),
+    # Dependencies
+    pipeline_service: PipelineService = Depends(get_pipeline_service),
+    execution_service: PipelineExecutionService = Depends(get_pipeline_execution_service),
+    ingest_service: IngestService = Depends(get_ingest_service),
+):
+    """
+    Submit documents for processing through a ContentFlow pipeline.
+
+    Accepts multipart form data with case details and document files.
+    Generates ProvidedDetails.json from the payload, uploads everything
+    to blob storage, and triggers the pipeline.
+
+    Returns 202 Accepted with an execution_id for polling.
+    """
+    settings = get_settings()
+
+    # --- Validate case_id ---
+    try:
+        ingest_service.validate_case_id(case_id)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+    # --- Validate files ---
+    if not files:
+        raise HTTPException(status_code=400, detail="At least one file is required.")
+
+    if len(files) > settings.INGEST_MAX_FILE_COUNT:
+        raise HTTPException(
+            status_code=400,
+            detail=f"Too many files. Maximum allowed: {settings.INGEST_MAX_FILE_COUNT}",
+        )
+
+    allowed_extensions = settings.INGEST_ALLOWED_EXTENSIONS
+    max_file_bytes = settings.INGEST_MAX_FILE_SIZE_MB * 1024 * 1024
+    max_total_bytes = settings.INGEST_MAX_TOTAL_SIZE_MB * 1024 * 1024
+    total_size = 0
+
+    for f in files:
+        # Validate extension
+        fname = f.filename or ""
+        ext = os.path.splitext(fname)[1].lower()
+        if ext not in allowed_extensions:
+            raise HTTPException(
+                status_code=400,
+                detail=f"File type '{ext}' not allowed for file '{fname}'. Allowed: {allowed_extensions}",
+            )
+        # Validate size (if known)
+        if f.size is not None:
+            if f.size > max_file_bytes:
+                raise HTTPException(
+                    status_code=413,
+                    detail=f"File '{fname}' exceeds maximum size of {settings.INGEST_MAX_FILE_SIZE_MB} MB.",
+                )
+            total_size += f.size
+
+    if total_size > max_total_bytes:
+        raise HTTPException(
+            status_code=413,
+            detail=f"Total upload size exceeds maximum of {settings.INGEST_MAX_TOTAL_SIZE_MB} MB.",
+        )
+
+    # --- Validate pipeline ---
+    pipeline = await pipeline_service.get_pipeline_by_id(pipeline_id)
+    if not pipeline:
+        raise HTTPException(status_code=404, detail="Pipeline not found.")
+    if not pipeline.enabled:
+        raise HTTPException(status_code=400, detail="Pipeline is disabled.")
+
+    # --- Create execution record first (to get execution_id for folder name) ---
+    try:
+        execution = await execution_service.create_execution(
+            pipeline=pipeline,
+            inputs={},  # will be updated after folder name is determined
+            created_by=None,
+        )
+    except Exception as e:
+        raise HTTPException(
+            status_code=500, detail=f"Failed to create execution record: {e}"
+        )
+
+    execution_id = execution.id
+    folder_prefix = f"input/{case_id}_{execution_id}/"
+
+    # --- Build payload model ---
+    payload = IngestPayload(
+        caseId=case_id,
+        firstName=first_name,
+        lastName=last_name,
+        mailingAddress=mailing_address,
+        dateOfBirth=date_of_birth,
+        dateOfDeath=date_of_death or "",
+        fatherFirstName=father_first_name or "",
+        fatherLastName=father_last_name or "",
+        motherFirstName=mother_first_name or "",
+        motherLastName=mother_last_name or "",
+    )
+
+    # --- Upload files and ProvidedDetails.json ---
+    try:
+        # Generate and upload ProvidedDetails.json
+        provided_details_bytes = ingest_service.generate_provided_details(payload)
+        await ingest_service.upload_provided_details(folder_prefix, provided_details_bytes)
+
+        # Upload document files
+        uploaded_paths = await ingest_service.upload_files(folder_prefix, files)
+    except Exception as e:
+        # Mark execution as failed if upload fails
+        await execution_service.update_execution_status(
+            execution_id, ExecutionStatus.FAILED, error=f"File upload failed: {e}"
+        )
+        raise HTTPException(status_code=500, detail=f"File upload failed: {e}")
+
+    # --- Update execution inputs with case_prefix ---
+    try:
+        exec_record = await execution_service.get_execution(execution_id)
+        if exec_record:
+            exec_record.inputs = {
+                "case_id": case_id,
+                "case_prefix": folder_prefix,
+                "execution_id": execution_id,
+            }
+            await execution_service.update(
+                exec_record.model_dump(by_alias=True, exclude_none=False)
+            )
+    except Exception as e:
+        logger.warning(f"Failed to update execution inputs: {e}")
+
+    # --- Trigger pipeline execution in background ---
+    background_tasks.add_task(
+        execution_service.start_execution,
+        execution_id=execution_id,
+        pipeline=pipeline,
+    )
+
+    return IngestResponse(
+        execution_id=execution_id,
+        case_id=case_id,
+        status="pending",
+        files_uploaded=len(uploaded_paths),
+        blob_prefix=folder_prefix,
+        pipeline_id=pipeline.id,
+        pipeline_name=pipeline.name,
+    )
diff --git a/contentflow-api/app/services/ingest_service.py b/contentflow-api/app/services/ingest_service.py
new file mode 100644
index 0000000..18c7301
--- /dev/null
+++ b/contentflow-api/app/services/ingest_service.py
@@ -0,0 +1,119 @@
+"""
+Ingest service for handling document uploads and ProvidedDetails.json generation.
+"""
+import json
+import logging
+import re
+from typing import List
+
+from fastapi import UploadFile
+
+from app.models import IngestPayload
+from app.utils.blob_storage import BlobStorageService
+
+logger = logging.getLogger("contentflow.api.services.ingest_service")
+
+# Characters allowed in case_id: alphanumeric, hyphens, underscores
+CASE_ID_PATTERN = re.compile(r"^[a-zA-Z0-9_\-]{1,128}$")
+
+
+class IngestService:
+    """Service for document ingestion: upload, ProvidedDetails generation, validation."""
+
+    def __init__(self, blob_service: BlobStorageService):
+        self.blob_service = blob_service
+
+    def validate_case_id(self, case_id: str) -> None:
+        """Validate case_id format. Raises ValueError on invalid format."""
+        if not case_id or not case_id.strip():
+            raise ValueError("case_id is required and cannot be empty.")
+        if not CASE_ID_PATTERN.match(case_id):
+            raise ValueError(
+                f"Invalid case_id format: '{case_id}'. "
+                "Only alphanumeric characters, hyphens, and underscores are allowed (max 128 chars)."
+            )
+
+    def sanitize_filename(self, filename: str) -> str:
+        """Sanitize a filename to prevent path traversal and invalid characters."""
+        # Remove any path components
+        name = filename.replace("\\", "/").split("/")[-1]
+        # Remove leading dots
+        name = name.lstrip(".")
+        # Remove null bytes
+        name = name.replace("\x00", "")
+        # Replace other problematic characters
+        name = re.sub(r'[<>:"|?*]', "_", name)
+        if not name:
+            raise ValueError(f"Invalid filename after sanitization: '{filename}'")
+        return name
+
+    def generate_provided_details(self, payload: IngestPayload) -> bytes:
+        """
+        Generate ProvidedDetails.json content from the ingest payload.
+
+        Uses the simple approach: all relevant fields are included in a single
+        details block. The validation rules engine selects which fields to check
+        per document type.
+        """
+        # Field names must match rules.json / FetchedDetails conventions
+        # (PascalCase, matching Azure Content Understanding output fields)
+        full_name = f"{payload.firstName} {payload.lastName}".strip()
+        details = {
+            "FirstName": payload.firstName,
+            "LastName": payload.lastName,
+            "FullName": full_name,
+            "Address": payload.mailingAddress,
+            "BirthDate": payload.dateOfBirth,
+        }
+        if payload.dateOfDeath:
+            details["dateOfDeath"] = payload.dateOfDeath
+        if payload.fatherFirstName:
+            details["FatherFirstName"] = payload.fatherFirstName
+        if payload.fatherLastName:
+            details["FatherLastName"] = payload.fatherLastName
+        if payload.motherFirstName:
+            details["MotherFirstName"] = payload.motherFirstName
+        if payload.motherLastName:
+            details["MotherLastName"] = payload.motherLastName
+
+        provided_details = {
+            "caseId": payload.caseId,
+            "details": details,
+        }
+
+        return json.dumps(provided_details, indent=2, ensure_ascii=False).encode("utf-8")
+
+    async def upload_files(
+        self, folder_prefix: str, files: List[UploadFile]
+    ) -> List[str]:
+        """
+        Upload document files to blob storage under the given folder prefix.
+
+        Returns list of uploaded blob paths.
+        """
+        uploaded_paths = []
+        for file in files:
+            sanitized_name = self.sanitize_filename(file.filename)
+            blob_name = f"{folder_prefix}{sanitized_name}"
+            content = await file.read()
+            await self.blob_service.upload_file(
+                file_content=content,
+                blob_name=blob_name,
+                content_type=file.content_type,
+            )
+            uploaded_paths.append(blob_name)
+            logger.info(f"Uploaded file: {blob_name}")
+        return uploaded_paths
+
+    async def upload_provided_details(
+        self, folder_prefix: str, content: bytes
+    ) -> str:
+        """Upload generated ProvidedDetails.json to the case folder."""
+        blob_name = f"{folder_prefix}ProvidedDetails.json"
+        await self.blob_service.upload_file(
+            file_content=content,
+            blob_name=blob_name,
+            content_type="application/json",
+        )
+        logger.info(f"Uploaded ProvidedDetails.json: {blob_name}")
+        return blob_name
diff --git a/contentflow-api/app/services/pipeline_execution_service.py b/contentflow-api/app/services/pipeline_execution_service.py
index f6b7f92..2754036 100644
--- a/contentflow-api/app/services/pipeline_execution_service.py
+++ b/contentflow-api/app/services/pipeline_execution_service.py
@@ -26,7 +26,7 @@
 
 # Import contentflow library components
 from contentflow.pipeline import PipelineExecutor as ContentFlowPipelineExecutor
-from contentflow.models import Content
+from contentflow.models import Content, ContentIdentifier
 from contentflow.utils import make_safe_json
 
 logger = logging.getLogger("contentflow.api.services.pipeline_execution_service")
@@ -154,8 +154,31 @@ async def execute_pipeline_async(
                     
                     has_pipeline_failed = False
                     
+                    # Build initial input from execution record inputs
+                    # If case_prefix is present (ingest API flow), pass a Content
+                    # object so the blob input discovery executor can use
+                    # prefix_from_input_field to scope to the correct folder.
+                    initial_input = []
+                    execution_record = await self.get_execution(execution_id)
+                    if (
+                        execution_record
+                        and execution_record.inputs
+                        and execution_record.inputs.get("case_prefix")
+                    ):
+                        initial_input = Content(
+                            id=ContentIdentifier(
+                                canonical_id=f"ingest-{execution_id}",
+                                unique_id=execution_id,
+                                source_name="ingest_api",
+                            ),
+                            data={
+                                "case_prefix": execution_record.inputs["case_prefix"],
+                                "execution_id": execution_id,
+                            },
+                        )
+                    
                     # Execute and collect events
-                    async for event in executor.execute_stream([]):
+                    async for event in executor.execute_stream(initial_input):
                         # Convert to our event model
                         exec_event = PipelineExecutionEvent(
                             event_type=event.event_type,
diff --git a/contentflow-api/app/settings.py b/contentflow-api/app/settings.py
index 3789f55..7af7059 100644
--- a/contentflow-api/app/settings.py
+++ b/contentflow-api/app/settings.py
@@ -64,6 +64,15 @@ class AppSettings(BaseModel):
 
     WORKER_ENGINE_API_ENDPOINT: str = "http://localhost:8099"
 
+    # Ingest API settings
+    INGEST_MAX_FILE_COUNT: int = 20
+    INGEST_MAX_FILE_SIZE_MB: int = 100
+    INGEST_MAX_TOTAL_SIZE_MB: int = 500
+    INGEST_ALLOWED_EXTENSIONS: list[str] = [
+        ".pdf", ".docx", ".pptx", ".xlsx",
+        ".png", ".jpg", ".jpeg", ".tiff"
+    ]
+
     def __init__(self, **kwargs):
         """Initialize AppSettings and load configuration from Azure App Configuration"""
         super().__init__(**kwargs)
diff --git a/contentflow-api/app/startup.py b/contentflow-api/app/startup.py
index a00af5e..273c380 100644
--- a/contentflow-api/app/startup.py
+++ b/contentflow-api/app/startup.py
@@ -5,7 +5,7 @@
 import logging
 from opentelemetry import trace
 
-from app.dependencies import initialize_cosmos, initialize_blob_storage, initialize_executor_catalog
+from app.dependencies import initialize_cosmos, initialize_blob_storage, initialize_executor_catalog, initialize_seed_pipelines
 
 logger = logging.getLogger("contentflow.api.startup")
 
@@ -17,6 +17,7 @@ async def startup_tasks():
         initialize_cosmos(),
         initialize_blob_storage(),
         initialize_executor_catalog(),
+        initialize_seed_pipelines(),
         # Add other startup tasks here
     ]
     
diff --git a/contentflow-api/main.py b/contentflow-api/main.py
index 2a36fe9..0da8867 100644
--- a/contentflow-api/main.py
+++ b/contentflow-api/main.py
@@ -12,7 +12,7 @@
 
 from app.settings import get_settings
 from app.startup import startup, shutdown
-from app.routers import health_router, pipelines_router, executors_router, vaults_router
+from app.routers import health_router, pipelines_router, executors_router, vaults_router, ingest_router
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
@@ -45,6 +45,7 @@ def initialize_api_application() -> FastAPI:
     app.include_router(pipelines_router, prefix="/api")
     app.include_router(executors_router, prefix="/api")
     app.include_router(vaults_router, prefix="/api")
+    app.include_router(ingest_router, prefix="/api")
 
     # # Global exception handler
     # @app.exception_handler(Exception)
diff --git a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
index abd88f4..2b21653 100644
--- a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
+++ b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
@@ -1,6 +1,8 @@
 pipeline:
-  name: Draft Fetched Details
-  description: Processes documents from blob folder, classifies types, extracts details, outputs fetched_details.json
+  name: Draft details extraction and validation pipeline
+  description: |-
+    Processes documents from blob folder, classifies types, extracts details, outputs fetched_details.json
+    and validates the fetched details
   executors:
     - id: azure_blob_input_discovery-1777658905426
       name: Discover Input Files
@@ -21,11 +23,11 @@ pipeline:
         blob_storage_account_key: ''
         blob_container_name: content
         discover_mode: files
-        prefix_from_input_field: ''
+        prefix_from_input_field: case_prefix
         prefix: input/
         file_extensions: .pdf,.docx,.pptx,.xlsx,.png,.jpg,.jpeg,.tiff
         max_depth: 1
-        max_results: 5
+        max_results: 20
         batch_size: 10
         include_metadata: true
         sort_by: name
@@ -202,8 +204,8 @@ pipeline:
         credential_type: default_azure_credential
         credential_key: ''
         container_name: content
-        path_template: 'Fetched_Details/exec_{execution_id}_{timestamp}/'
-        filename_template: 'FetchedDetails_{id.unique_id}_{timestamp}.json'
+        path_template: Fetched_Details/{execution_id}/
+        filename_template: FetchedDetails_{id.unique_id}_{timestamp}.json
         content_field: document_record
         metadata_fields: ''
         compression: ''
@@ -217,8 +219,8 @@ pipeline:
       name: Document Validation
       type: document_validation
       position:
-        x: 406
-        'y': 1162
+        x: 407
+        'y': 1161
       description: >-
         Validates fetched document details against provided details using configurable rules. Supports exact match, date
         match, expiry check, name match, and AI-powered address matching.
@@ -234,15 +236,18 @@ pipeline:
         rules_filename: rules.json
         fetched_details_prefix: FetchedDetails_
         output_filename: results.json
-        base_path: input
+        base_path: ''
         fetched_details_path: ''
         fetched_details_path_field: blob_output.blob_path
         case_sensitive_comparison: false
         input_prefix_field: blob_path
+        rules_base_path: ''
+        cleanup_input_after_results: true
+        cleanup_preserve_files: results.json
         endpoint: ${AZURE_OPENAI_ENDPOINT}
         deployment_name: ''
         credential_type: default_azure_credential
-        api_key: ''
+        api_key: https://aiaifdoa37xivbqipl5.openai.azure.com/
         temperature: 0.1
   edges:
     - from: azure_blob_input_discovery-1777658905426
diff --git a/contentflow-api/seed/test_ingest_api.py b/contentflow-api/seed/test_ingest_api.py
new file mode 100644
index 0000000..7ab85d3
--- /dev/null
+++ b/contentflow-api/seed/test_ingest_api.py
@@ -0,0 +1,257 @@
+"""
+Test script for the POST /api/ingest multipart document submission endpoint.
+
+Usage:
+    1. Place your test documents in a folder (default: ./input)
+    2. Set BASE_URL to your API host (local or Azure)
+    3. Set PIPELINE_ID to a valid pipeline ID from your Cosmos DB
+    4. Run:
+         python test_ingest_api.py
+
+What this script does:
+    - Step 1: Sends a multipart POST to /api/ingest with case details (form fields)
+              and all document files found in the INPUT_DIR folder.
+    - Step 2: Prints the 202 Accepted response (execution_id, blob_prefix, etc.).
+    - Step 3: Polls GET /api/pipelines/executions/{execution_id} every few seconds
+              until the pipeline completes, fails, or the poll limit is reached.
+    - Step 4: Prints a final summary with the execution status.
+
+Where to check responses:
+    - CONSOLE:  All responses are printed to stdout.
+    - SWAGGER:  Open {BASE_URL}/docs in a browser to test interactively.
+    - COSMOS DB: Query the "executions" container for the returned execution_id.
+    - BLOB:     Check Azure Blob Storage container → input/{caseId}_{executionId}/
+                  • ProvidedDetails.json   — generated from form fields
+                  • your uploaded documents — as submitted
+                  • results.json           — written by the validation executor
+"""
+
+import os
+import sys
+import time
+import json
+import requests
+
+# ──────────────────────────────────────────────
+#  CONFIGURATION — edit these before running
+# ──────────────────────────────────────────────
+
+# API base URL (no trailing slash)
+#   Local:  http://localhost:8090
+#   Azure:  https://<your-container-app>.azurecontainerapps.io
+BASE_URL = os.environ.get("CONTENTFLOW_API_URL", "https://api-doa37xivbuto4.wittywave-d4ca8c39.eastus.azurecontainerapps.io")
+
+# A valid pipeline ID from Cosmos DB that is enabled and linked to the
+# blob input discovery → content understanding → document validation flow.
+PIPELINE_ID = os.environ.get("CONTENTFLOW_PIPELINE_ID", "draft_details_extraction_and_validation_pipeline_d0e4eeb7")
+
+# Folder containing the test documents to upload (PDFs, images, etc.)
+INPUT_DIR = os.environ.get("CONTENTFLOW_INPUT_DIR", os.path.join(os.path.dirname(__file__), "input"))
+
+# Polling settings
+POLL_INTERVAL_SECONDS = 5
+POLL_MAX_ATTEMPTS = 60  # 5 minutes max
+
+# ──────────────────────────────────────────────
+#  SAMPLE CASE DATA — edit to match your rules
+# ──────────────────────────────────────────────
+CASE_DATA = {
+    "caseId": "20261117253",
+    "firstName": "Lizandra",
+    "lastName": "Martes Sierra",
+    "mailingAddress": "123 Calle Luna, San Juan, PR 00901",
+    "dateOfBirth": "1985-06-15",
+    "dateOfDeath": "",
+    "fatherFirstName": "Juan",
+    "fatherLastName": "Orozco",
+    "motherFirstName": "Maria",
+    "motherLastName": "Dones",
+}
+
+
+def collect_files(input_dir: str) -> list[str]:
+    """Collect all supported files from the input directory."""
+    allowed = {".pdf", ".docx", ".pptx", ".xlsx", ".png", ".jpg", ".jpeg", ".tiff"}
+    if not os.path.isdir(input_dir):
+        print(f"ERROR: Input directory not found: {input_dir}")
+        print(f"       Create this folder and place your test documents inside it.")
+        sys.exit(1)
+
+    files = []
+    for fname in sorted(os.listdir(input_dir)):
+        ext = os.path.splitext(fname)[1].lower()
+        if ext in allowed:
+            files.append(os.path.join(input_dir, fname))
+
+    if not files:
+        print(f"ERROR: No supported document files found in: {input_dir}")
+        print(f"       Supported extensions: {allowed}")
+        sys.exit(1)
+
+    return files
+
+
+def submit_ingest(base_url: str, pipeline_id: str, case_data: dict, file_paths: list[str]) -> dict:
+    """
+    POST /api/ingest — multipart form data with case fields + files.
+    Returns the parsed JSON response (IngestResponse).
+    """
+    url = f"{base_url}/api/ingest/"
+
+    # Build form fields (sent as multipart form data, not JSON)
+    form_data = {**case_data, "pipeline_id": pipeline_id}
+
+    # Build file tuples: ("files", (filename, file_handle, content_type))
+    file_handles = []
+    files_payload = []
+    for path in file_paths:
+        fname = os.path.basename(path)
+        fh = open(path, "rb")
+        file_handles.append(fh)
+        files_payload.append(("files", (fname, fh, "application/octet-stream")))
+
+    print("=" * 60)
+    print("STEP 1 — Submitting ingest request")
+    print("=" * 60)
+    print(f"  URL:         {url}")
+    print(f"  Pipeline:    {pipeline_id}")
+    print(f"  Case ID:     {case_data['caseId']}")
+    print(f"  Files ({len(file_paths)}):")
+    for p in file_paths:
+        size_kb = os.path.getsize(p) / 1024
+        print(f"    • {os.path.basename(p)}  ({size_kb:.1f} KB)")
+    print()
+
+    try:
+        resp = requests.post(url, data=form_data, files=files_payload, timeout=120)
+    finally:
+        for fh in file_handles:
+            fh.close()
+
+    print(f"  HTTP Status: {resp.status_code}")
+
+    if resp.status_code == 202:
+        result = resp.json()
+        print(f"  Response:")
+        print(json.dumps(result, indent=4))
+        return result
+    else:
+        print(f"  ERROR RESPONSE:")
+        try:
+            print(json.dumps(resp.json(), indent=4))
+        except Exception:
+            print(resp.text)
+        sys.exit(1)
+
+
+def poll_execution(base_url: str, execution_id: str) -> dict:
+    """
+    GET /api/pipelines/executions/{execution_id} — poll until terminal state.
+    Returns the final execution record.
+    """
+    url = f"{base_url}/api/pipelines/executions/{execution_id}"
+
+    print()
+    print("=" * 60)
+    print("STEP 2 — Polling execution status")
+    print("=" * 60)
+    print(f"  URL:          {url}")
+    print(f"  Execution ID: {execution_id}")
+    print(f"  Interval:     {POLL_INTERVAL_SECONDS}s (max {POLL_MAX_ATTEMPTS} attempts)")
+    print()
+
+    terminal_states = {"completed", "failed", "cancelled"}
+
+    for attempt in range(1, POLL_MAX_ATTEMPTS + 1):
+        try:
+            resp = requests.get(url, timeout=30)
+        except requests.RequestException as e:
+            print(f"  [{attempt:3d}] Connection error: {e}")
+            time.sleep(POLL_INTERVAL_SECONDS)
+            continue
+
+        if resp.status_code == 200:
+            data = resp.json()
+            status = data.get("status", "unknown")
+            print(f"  [{attempt:3d}] Status: {status}")
+
+            if status in terminal_states:
+                print()
+                print("  Final execution record:")
+                print(json.dumps(data, indent=4, default=str))
+                return data
+        elif resp.status_code == 404:
+            print(f"  [{attempt:3d}] Execution not found (may still be creating)")
+        else:
+            print(f"  [{attempt:3d}] HTTP {resp.status_code}: {resp.text[:200]}")
+
+        time.sleep(POLL_INTERVAL_SECONDS)
+
+    print()
+    print("  WARNING: Max poll attempts reached. The pipeline may still be running.")
+    print(f"  Check manually: {url}")
+    return {}
+
+
+def print_summary(ingest_response: dict, execution_result: dict):
+    """Print a final summary of the test run."""
+    print()
+    print("=" * 60)
+    print("SUMMARY")
+    print("=" * 60)
+    print(f"  Case ID:        {ingest_response.get('case_id')}")
+    print(f"  Execution ID:   {ingest_response.get('execution_id')}")
+    print(f"  Blob Prefix:    {ingest_response.get('blob_prefix')}")
+    print(f"  Files Uploaded:  {ingest_response.get('files_uploaded')}")
+    print(f"  Pipeline:       {ingest_response.get('pipeline_name')} ({ingest_response.get('pipeline_id')})")
+
+    final_status = execution_result.get("status", "unknown")
+    print(f"  Final Status:   {final_status}")
+
+    if final_status == "completed":
+        print()
+        print("  SUCCESS — Pipeline completed. Check these locations:")
+    elif final_status == "failed":
+        error = execution_result.get("error", "")
+        print(f"  Error:          {error}")
+        print()
+        print("  FAILED — Check these locations for debugging:")
+    else:
+        print()
+        print("  Check these locations:")
+
+    blob_prefix = ingest_response.get("blob_prefix", "input/<caseId>_<executionId>/")
+    print(f"    Blob Storage:  container → {blob_prefix}")
+    print(f"        • ProvidedDetails.json  (generated from form fields)")
+    print(f"        • results.json          (validation output)")
+    print(f"    Cosmos DB:     executions container → id = {ingest_response.get('execution_id')}")
+    print(f"    Swagger UI:    {BASE_URL}/docs")
+    print(f"    Polling URL:   {BASE_URL}/api/pipelines/executions/{ingest_response.get('execution_id')}")
+    print()
+
+
+if __name__ == "__main__":
+    print()
+    print("ContentFlow Ingest API — Integration Test")
+    print("=" * 60)
+
+    if PIPELINE_ID == "<YOUR_PIPELINE_ID>":
+        print("ERROR: Set PIPELINE_ID to a valid pipeline ID before running.")
+        print("       Either edit this file or set CONTENTFLOW_PIPELINE_ID env var.")
+        print()
+        print("       Find pipeline IDs via:")
+        print(f"         GET {BASE_URL}/api/pipelines/")
+        sys.exit(1)
+
+    # Collect document files from input folder
+    file_paths = collect_files(INPUT_DIR)
+
+    # Step 1: Submit ingest
+    ingest_response = submit_ingest(BASE_URL, PIPELINE_ID, CASE_DATA, file_paths)
+
+    # Step 2: Poll until complete
+    execution_id = ingest_response["execution_id"]
+    execution_result = poll_execution(BASE_URL, execution_id)
+
+    # Step 3: Summary
+    print_summary(ingest_response, execution_result)
diff --git a/contentflow-lib/contentflow/executors/azure_blob_input_discovery.py b/contentflow-lib/contentflow/executors/azure_blob_input_discovery.py
index 6690377..1a7c036 100644
--- a/contentflow-lib/contentflow/executors/azure_blob_input_discovery.py
+++ b/contentflow-lib/contentflow/executors/azure_blob_input_discovery.py
@@ -309,6 +309,14 @@ async def process_input(
                 f"container '{self.blob_container_name}' in {elapsed:.2f}s"
             )
             
+            # Propagate data fields from input content to each discovered item
+            # so downstream executors can reference parent context (e.g., execution_id)
+            if isinstance(input, Content) and input.data:
+                for item in content_items:
+                    for key, value in input.data.items():
+                        if key not in item.data:
+                            item.data[key] = value
+            
             # Virtual folder discovery mode
             if self.discover_mode == "virtual_folders":
                 return self._extract_virtual_folders(content_items)
diff --git a/contentflow-lib/contentflow/executors/document_validation_executor.py b/contentflow-lib/contentflow/executors/document_validation_executor.py
index 1f09d2f..13d5fd3 100644
--- a/contentflow-lib/contentflow/executors/document_validation_executor.py
+++ b/contentflow-lib/contentflow/executors/document_validation_executor.py
@@ -125,6 +125,16 @@ def __init__(
         self.base_path = self.get_setting("base_path", default=None)
         self.fetched_details_path = self.get_setting("fetched_details_path", default=None)
         self.fetched_details_path_field = self.get_setting("fetched_details_path_field", default="blob_output.blob_path")
+        # Read rules_base_path directly from settings dict because get_setting
+        # converts empty string to None, but empty string is a valid value
+        # meaning "container root".
+        self.rules_base_path = self.settings.get("rules_base_path", None)
+        if isinstance(self.rules_base_path, str):
+            self.rules_base_path = self.rules_base_path.strip()
+
+        # Cleanup settings
+        self.cleanup_input_after_results = self.get_setting("cleanup_input_after_results", default=False)
+        self.cleanup_preserve_files = self.get_setting("cleanup_preserve_files", default="results.json")
 
         # Comparison settings
         self.case_sensitive = self.get_setting("case_sensitive_comparison", default=False)
@@ -208,8 +218,20 @@ async def process_input(
             results = []
             for content in contents:
                 results.append(await self._process_single(content, current_run_blob_paths))
+            # Run cleanup ONCE after all content items are processed
+            if self.cleanup_input_after_results and results:
+                base_prefix = self._get_base_prefix(contents[0])
+                await self.blob_connector.initialize()
+                await self._cleanup_case_folder(base_prefix)
             return results
-        return await self._process_single(contents[0], current_run_blob_paths)
+
+        result = await self._process_single(contents[0], current_run_blob_paths)
+        # Run cleanup after the single item is processed
+        if self.cleanup_input_after_results:
+            base_prefix = self._get_base_prefix(contents[0])
+            await self.blob_connector.initialize()
+            await self._cleanup_case_folder(base_prefix)
+        return result
 
     def _collect_current_run_fetched_paths(self, contents: List[Content]) -> List[str]:
         """Collect all FetchedDetails blob paths written by upstream executors in the current run.
@@ -266,8 +288,11 @@ async def _process_single(self, content: Content, current_run_blob_paths: List[s
             if self.debug_mode:
                 logger.debug(f"{self.id}: Loaded ProvidedDetails with {len(provided_details.get('documents', []))} documents")
 
-            # Step 2: Load rules.json
-            rules = await self._load_json_from_blob(base_prefix, self.rules_filename)
+            # Step 2: Load rules.json (from rules_base_path if set, else from base_prefix)
+            rules_prefix = self._get_rules_prefix()
+            if rules_prefix is None:
+                rules_prefix = base_prefix
+            rules = await self._load_json_from_blob(rules_prefix, self.rules_filename)
             if self.debug_mode:
                 logger.debug(f"{self.id}: Loaded rules with {len(rules.get('rules', []))} document type rules")
 
@@ -285,6 +310,7 @@ async def _process_single(self, content: Content, current_run_blob_paths: List[s
             await self._write_results_to_blob(base_prefix, results)
 
             # Step 6: Store results in content for downstream use
+            # Note: cleanup is handled in process_input() after ALL items are done
             content.data["validation_results"] = results
             content.summary_data["validation_status"] = results.get("summary", {}).get("overallStatus", "unknown")
             content.summary_data["executor_status"] = "success"
@@ -345,7 +371,11 @@ def _get_base_prefix(self, content: Content) -> str:
             return prefix if prefix.endswith("/") else prefix + "/"
         if content.id and content.id.path:
             path = content.id.path
-            return path if path.endswith("/") else path + "/"
+            # content.id.path is typically a file path (e.g., input/case_001/doc.pdf)
+            # Extract the parent directory to get the case folder prefix
+            if "/" in path:
+                path = path.rsplit("/", 1)[0]
+            return f"{path}/" if path else ""
         raise ValueError(f"{self.id}: Cannot determine base path. Set 'base_path' in settings.")
 
     def _get_fetched_details_prefix(self, content: Content) -> str:
@@ -377,6 +407,53 @@ def _get_fetched_details_prefix(self, content: Content) -> str:
         # 3. Fall back to base path
         return self._get_base_prefix(content)
 
+    def _get_rules_prefix(self) -> str:
+        """Get the path prefix for loading rules.json.
+        
+        If rules_base_path is set (even to empty string), use it.
+        Returns None if not configured, so caller can fall back to base_prefix.
+        """
+        if self.rules_base_path is not None:
+            path = self.rules_base_path.strip("/")
+            return f"{path}/" if path else ""
+        return None
+
+    async def _cleanup_case_folder(self, base_prefix: str) -> None:
+        """Delete all blobs under the case folder prefix except preserved files.
+        
+        Preserves files listed in cleanup_preserve_files (comma-separated).
+        """
+        preserve_set = set()
+        if self.cleanup_preserve_files:
+            preserve_set = {f.strip() for f in self.cleanup_preserve_files.split(",") if f.strip()}
+
+        deleted_count = 0
+        async for blobs in self.blob_connector.list_blobs(
+            container_name=self.blob_container_name,
+            prefix=base_prefix,
+            max_results=1000,
+            batch_size=100
+        ):
+            if not blobs:
+                continue
+            for blob in blobs:
+                blob_name = blob.get("name", "")
+                filename = blob_name.split("/")[-1] if "/" in blob_name else blob_name
+                if filename in preserve_set:
+                    if self.debug_mode:
+                        logger.debug(f"{self.id}: Preserving {blob_name}")
+                    continue
+                try:
+                    await self.blob_connector.delete_blob(
+                        container_name=self.blob_container_name,
+                        blob_path=blob_name
+                    )
+                    deleted_count += 1
+                except Exception as e:
+                    logger.warning(f"{self.id}: Failed to delete {blob_name}: {e}")
+
+        logger.info(f"{self.id}: Cleanup complete — deleted {deleted_count} blob(s) from {base_prefix}")
+
     def _resolve_nested_field(self, data: dict, field_path: str):
         """Resolve a dot-notation field path from a dictionary.
         
@@ -512,10 +589,20 @@ async def _run_validation(
             "documentResults": []
         }
 
-        provided_docs = {
-            doc["documentType"]: doc["details"]
-            for doc in provided_details.get("documents", [])
-        }
+        # Support two ProvidedDetails formats:
+        # 1. Per-document: {"documents": [{"documentType": "Passport", "details": {...}}, ...]}
+        # 2. Flat/shared: {"caseId": "...", "details": {"firstName": "...", ...}}
+        #    In flat format, the same details apply to ALL document types.
+        if "documents" in provided_details and provided_details["documents"]:
+            provided_docs = {
+                doc["documentType"]: doc["details"]
+                for doc in provided_details["documents"]
+            }
+            shared_details = None
+        else:
+            provided_docs = {}
+            shared_details = provided_details.get("details", {})
+
         rules_by_type = {
             rule["documentType"]: rule["validations"]
             for rule in rules.get("rules", [])
@@ -531,8 +618,12 @@ async def _run_validation(
             }
             results["summary"]["totalDocuments"] += 1
 
-            # Find matching provided document
-            provided = self._find_matching_provided(fetched_doc_type, provided_docs)
+            # Find matching provided document details
+            # If flat format (shared_details), use the same details for all doc types
+            if shared_details is not None:
+                provided = shared_details
+            else:
+                provided = self._find_matching_provided(fetched_doc_type, provided_docs)
             if provided is None:
                 doc_result["status"] = "not_found"
                 doc_result["errors"].append({
diff --git a/contentflow-lib/executor_catalog.yaml b/contentflow-lib/executor_catalog.yaml
index 03299e4..00633a2 100644
--- a/contentflow-lib/executor_catalog.yaml
+++ b/contentflow-lib/executor_catalog.yaml
@@ -6257,7 +6257,7 @@ executor_catalog:
     class_name: DocumentValidationExecutor
     tags: [validation, comparison, rules, documents, azure-openai]
     category: "analyse"
-    version: "1.2"
+    version: "1.3"
 
     settings_schema:
       # Common settings
@@ -6398,6 +6398,31 @@ executor_catalog:
         default: "blob_path"
         ui_component: "input"
 
+      rules_base_path:
+        type: string
+        title: "Rules Base Path"
+        description: "Separate blob folder path for rules.json. Use empty string for container root. If not set, rules.json is loaded from the same location as base_path."
+        placeholder: ""
+        required: false
+        default: null
+        ui_component: "input"
+
+      cleanup_input_after_results:
+        type: boolean
+        title: "Cleanup Input After Results"
+        description: "Delete all blobs in the case folder after results.json is written. Preserved files are configured via 'Cleanup Preserve Files'."
+        required: false
+        default: false
+        ui_component: "checkbox"
+
+      cleanup_preserve_files:
+        type: string
+        title: "Cleanup Preserve Files"
+        description: "Comma-separated list of filenames to preserve during cleanup (e.g., 'results.json'). Only used when 'Cleanup Input After Results' is enabled."
+        required: false
+        default: "results.json"
+        ui_component: "input"
+
       # Azure OpenAI settings for AI-powered address matching
       endpoint:
         type: string

From fbaf190cead76a8f563a6d1f148cd63d7fff6c58 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Thu, 14 May 2026 14:16:59 +0000
Subject: [PATCH 07/28] feat: add GET /api/ingest/{execution_id}/results
 endpoint for retrieving validation results

---
 contentflow-api/app/models/__init__.py        |   3 +-
 contentflow-api/app/models/_ingest.py         |   8 ++
 contentflow-api/app/routers/ingest.py         | 101 +++++++++++++++-
 .../draft-fetched-details-pipeline.yaml       |  25 ++--
 contentflow-api/seed/test_ingest_api.py       | 110 ++++++++++++++++--
 5 files changed, 225 insertions(+), 22 deletions(-)

diff --git a/contentflow-api/app/models/__init__.py b/contentflow-api/app/models/__init__.py
index 3041371..b8c5980 100644
--- a/contentflow-api/app/models/__init__.py
+++ b/contentflow-api/app/models/__init__.py
@@ -17,7 +17,7 @@
     VaultExecution,
     VaultCrawlCheckpoint,
 )
-from ._ingest import IngestPayload, IngestResponse
+from ._ingest import IngestPayload, IngestResponse, IngestResultsResponse
 
 try:
     __version__ = importlib.metadata.version(__name__)
@@ -42,4 +42,5 @@
             "VaultCrawlCheckpoint",
             "IngestPayload",
             "IngestResponse",
+            "IngestResultsResponse",
           ]
\ No newline at end of file
diff --git a/contentflow-api/app/models/_ingest.py b/contentflow-api/app/models/_ingest.py
index 2d5663c..6dc9379 100644
--- a/contentflow-api/app/models/_ingest.py
+++ b/contentflow-api/app/models/_ingest.py
@@ -28,3 +28,11 @@ class IngestResponse(BaseModel):
     blob_prefix: str
     pipeline_id: str
     pipeline_name: str
+
+
+class IngestResultsResponse(BaseModel):
+    """Response for GET /ingest/{execution_id}/results"""
+    execution_id: str
+    status: str
+    results: Optional[dict] = None
+    error: Optional[str] = None
diff --git a/contentflow-api/app/routers/ingest.py b/contentflow-api/app/routers/ingest.py
index 760b4a8..2a97bcf 100644
--- a/contentflow-api/app/routers/ingest.py
+++ b/contentflow-api/app/routers/ingest.py
@@ -1,13 +1,16 @@
 """
 Ingest router for multipart document submission API.
 """
+import json
 import logging
 import os
 from typing import List, Optional
 
 from fastapi import APIRouter, BackgroundTasks, Depends, File, Form, HTTPException, UploadFile
+from fastapi.responses import JSONResponse
+from azure.core.exceptions import ResourceNotFoundError
 
-from app.models import IngestPayload, IngestResponse, ExecutionStatus
+from app.models import IngestPayload, IngestResponse, IngestResultsResponse, ExecutionStatus
 from app.services.pipeline_service import PipelineService
 from app.services.pipeline_execution_service import PipelineExecutionService
 from app.services.ingest_service import IngestService
@@ -17,6 +20,7 @@
     get_ingest_service,
 )
 from app.settings import get_settings
+from app.utils.blob_storage import BlobStorageService, get_blob_storage_service
 
 logger = logging.getLogger("contentflow.api.routers.ingest")
 
@@ -184,3 +188,98 @@ async def ingest_documents(
         pipeline_id=pipeline.id,
         pipeline_name=pipeline.name,
     )
+
+
+@router.get("/{execution_id}/results", response_model=IngestResultsResponse)
+async def get_ingest_results(
+    execution_id: str,
+    execution_service: PipelineExecutionService = Depends(get_pipeline_execution_service),
+):
+    """
+    Retrieve validation results for a completed ingest execution.
+
+    - **200**: Execution completed — returns results.json content.
+    - **202**: Execution is still running — retry later.
+    - **404**: Execution ID not found.
+    - **422**: Execution failed — returns error details.
+    """
+    # --- Validate execution_id format ---
+    if not execution_id or not execution_id.strip():
+        raise HTTPException(status_code=400, detail="execution_id is required.")
+
+    # --- Fetch execution record from Cosmos DB ---
+    try:
+        execution = await execution_service.get_execution(execution_id)
+    except Exception as e:
+        logger.error(f"Failed to look up execution {execution_id}: {e}")
+        raise HTTPException(status_code=500, detail="Unable to retrieve execution record.")
+
+    if not execution:
+        raise HTTPException(status_code=404, detail="Execution not found.")
+
+    # --- Handle non-terminal states ---
+    status = execution.status
+    if isinstance(status, ExecutionStatus):
+        status = status.value
+
+    if status in (ExecutionStatus.PENDING.value, ExecutionStatus.RUNNING.value):
+        return JSONResponse(
+            status_code=202,
+            content=IngestResultsResponse(
+                execution_id=execution_id,
+                status=status,
+            ).model_dump(),
+        )
+
+    # --- Handle failed / cancelled ---
+    if status in (ExecutionStatus.FAILED.value, ExecutionStatus.CANCELLED.value):
+        raise HTTPException(
+            status_code=422,
+            detail={
+                "execution_id": execution_id,
+                "status": status,
+                "error": execution.error or "Execution did not complete successfully.",
+            },
+        )
+
+    # --- Execution completed — download results.json from blob ---
+    case_prefix = (execution.inputs or {}).get("case_prefix")
+    if not case_prefix:
+        raise HTTPException(
+            status_code=500,
+            detail="Execution record is missing case_prefix — cannot locate results.",
+        )
+
+    results_blob_path = f"{case_prefix}results.json"
+
+    settings = get_settings()
+    try:
+        blob_service = await get_blob_storage_service(
+            account_name=settings.BLOB_STORAGE_ACCOUNT_NAME,
+            container_name=settings.BLOB_STORAGE_CONTAINER_NAME,
+        )
+        raw_bytes = await blob_service.download_file(results_blob_path)
+        results_data = json.loads(raw_bytes)
+    except ResourceNotFoundError:
+        raise HTTPException(
+            status_code=404,
+            detail=f"Results file not found at {results_blob_path}. The pipeline may not have produced results.",
+        )
+    except json.JSONDecodeError:
+        logger.error(f"Malformed results.json at {results_blob_path}")
+        raise HTTPException(
+            status_code=500,
+            detail="Results file exists but contains invalid JSON.",
+        )
+    except Exception as e:
+        logger.error(f"Error downloading results for {execution_id}: {e}")
+        raise HTTPException(
+            status_code=500,
+            detail="Failed to retrieve results from storage.",
+        )
+
+    return IngestResultsResponse(
+        execution_id=execution_id,
+        status=status,
+        results=results_data,
+    )
diff --git a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
index 2b21653..f45c3ca 100644
--- a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
+++ b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
@@ -1,5 +1,5 @@
 pipeline:
-  name: Draft details extraction and validation pipeline
+  name: Details extraction and validation pipeline
   description: |-
     Processes documents from blob folder, classifies types, extracts details, outputs fetched_details.json
     and validates the fetched details
@@ -88,8 +88,8 @@ pipeline:
       name: Classify Document Type
       type: content_classifier
       position:
-        x: 403
-        'y': 541
+        x: 405
+        'y': 543
       description: Classify text into predefined categories with confidence scores
       settings:
         enabled: true
@@ -97,12 +97,19 @@ pipeline:
         fail_pipeline_on_error: true
         debug_mode: true
         categories: >-
-          {"Driving License": "Driver's license, driving permit, or DL issued by government", "Passport": "International
-          travel passport document", "Water Utility bill": "Water service bill or statement", "Power Utility bill":
-          "Electricity or power service bill", "Telecom Utility bill": "Phone, internet, or telecom service bill", "Real
-          ID": "Real ID": "REAL ID compliant identification card, REAL ID driver's license, or federally compliant
-          government ID with star marking issued under the REAL ID Act", "Unrecognized": "Document does not match any of
-          the above categories"}
+          {   "Driving License": "Government-issued driver's license, driving permit, or DL used as an official proof of
+          identity",   "Passport": "Government-issued passport document used for international travel and identity
+          verification",   "Real ID": "REAL ID–compliant identification card or driver's license issued by a government
+          authority under the REAL ID Act, typically marked with a star",   "Water Utility bill": "Water service utility
+          bill or statement issued by a municipal or private water service provider",   "Power Utility bill":
+          "Electricity or power service utility bill or statement issued by an energy or power provider",   "Telecom
+          utility bill_claro": "Telecommunications service bill issued by Claro, including mobile, internet, or related
+          telecom services",   "Telecom utility bill_liberty": "Telecommunications service bill issued by Liberty,
+          including mobile, internet, or related telecom services",   "Telecom utility bill_tmobile":
+          "Telecommunications service bill issued by T-Mobile, including mobile, internet, or related telecom
+          services",   "Certification of death": "Official death certificate or certification of death issued by a
+          government authority, hospital, or civil registry",   "Unrecognized": "Document does not match any of the
+          predefined document categories" }
         multi_label: false
         include_confidence: true
         category_descriptions: ''
diff --git a/contentflow-api/seed/test_ingest_api.py b/contentflow-api/seed/test_ingest_api.py
index 7ab85d3..f633eed 100644
--- a/contentflow-api/seed/test_ingest_api.py
+++ b/contentflow-api/seed/test_ingest_api.py
@@ -56,16 +56,16 @@
 #  SAMPLE CASE DATA — edit to match your rules
 # ──────────────────────────────────────────────
 CASE_DATA = {
-    "caseId": "20261117253",
-    "firstName": "Lizandra",
-    "lastName": "Martes Sierra",
-    "mailingAddress": "123 Calle Luna, San Juan, PR 00901",
-    "dateOfBirth": "1985-06-15",
-    "dateOfDeath": "",
-    "fatherFirstName": "Juan",
-    "fatherLastName": "Orozco",
-    "motherFirstName": "Maria",
-    "motherLastName": "Dones",
+    "caseId": "20261117254",
+    "firstName": "JONATHAN",
+    "lastName": "DIAZ CARTAGENA",
+    "mailingAddress": "URB PRADERA A-K5 CALLE 8, Toa Baja PR 00949",
+    "dateOfBirth": "2010-11-12",
+    # "dateOfDeath": "",
+    # "fatherFirstName": "Juan",
+    # "fatherLastName": "Orozco",
+    # "motherFirstName": "Maria",
+    # "motherLastName": "Dones",
 }
 
 
@@ -227,14 +227,94 @@ def print_summary(ingest_response: dict, execution_result: dict):
     print(f"    Cosmos DB:     executions container → id = {ingest_response.get('execution_id')}")
     print(f"    Swagger UI:    {BASE_URL}/docs")
     print(f"    Polling URL:   {BASE_URL}/api/pipelines/executions/{ingest_response.get('execution_id')}")
+    print(f"    Results URL:   {BASE_URL}/api/ingest/{ingest_response.get('execution_id')}/results")
     print()
 
 
+def fetch_results(base_url: str, execution_id: str, save_dir: str = None) -> dict:
+    """
+    GET /api/ingest/{execution_id}/results — fetch validation results.
+    Optionally saves the results JSON to save_dir for local verification.
+    Returns the parsed JSON response or empty dict on failure.
+    """
+    url = f"{base_url}/api/ingest/{execution_id}/results"
+
+    print()
+    print("=" * 60)
+    print("STEP 3 — Fetching validation results")
+    print("=" * 60)
+    print(f"  URL: {url}")
+    print()
+
+    try:
+        resp = requests.get(url, timeout=30)
+    except requests.RequestException as e:
+        print(f"  Connection error: {e}")
+        return {}
+
+    print(f"  HTTP Status: {resp.status_code}")
+
+    if resp.status_code == 200:
+        data = resp.json()
+        results = data.get("results", {})
+        summary = results.get("summary", {})
+        print(f"  Overall status:  {summary.get('overallStatus', 'N/A')}")
+        print(f"  Total documents: {summary.get('totalDocuments', 'N/A')}")
+        print(f"  Passed:          {summary.get('passed', 'N/A')}")
+        print(f"  Failed:          {summary.get('failed', 'N/A')}")
+        print()
+        print("  Full results JSON:")
+        print(json.dumps(data, indent=4, default=str))
+
+        # Save to local file for verification
+        if save_dir:
+            os.makedirs(save_dir, exist_ok=True)
+            out_path = os.path.join(save_dir, f"results_{execution_id}.json")
+            with open(out_path, "w", encoding="utf-8") as f:
+                json.dump(data, f, indent=4, default=str)
+            print()
+            print(f"  Saved results to: {out_path}")
+
+        return data
+    elif resp.status_code == 202:
+        print("  Pipeline still running. Results not available yet.")
+        return {}
+    elif resp.status_code == 404:
+        print("  Execution or results not found.")
+        try:
+            print(f"  Detail: {resp.json().get('detail', '')}")
+        except Exception:
+            pass
+        return {}
+    elif resp.status_code == 422:
+        print("  Execution did not complete successfully.")
+        try:
+            detail = resp.json().get("detail", {})
+            print(f"  Status: {detail.get('status', 'unknown')}")
+            print(f"  Error:  {detail.get('error', 'N/A')}")
+        except Exception:
+            print(f"  Response: {resp.text[:300]}")
+        return {}
+    else:
+        print(f"  Unexpected response: {resp.text[:300]}")
+        return {}
+
+
 if __name__ == "__main__":
     print()
     print("ContentFlow Ingest API — Integration Test")
     print("=" * 60)
 
+    # ── GET-only mode: pass an execution_id as argument ──
+    #   python test_ingest_api.py exec_abc123def456
+    if len(sys.argv) > 1:
+        execution_id = sys.argv[1].strip()
+        print(f"  Mode:         GET results only")
+        print(f"  Execution ID: {execution_id}")
+        fetch_results(BASE_URL, execution_id, save_dir=INPUT_DIR)
+        sys.exit(0)
+
+    # ── Full mode: POST + poll + GET results ──
     if PIPELINE_ID == "<YOUR_PIPELINE_ID>":
         print("ERROR: Set PIPELINE_ID to a valid pipeline ID before running.")
         print("       Either edit this file or set CONTENTFLOW_PIPELINE_ID env var.")
@@ -253,5 +333,13 @@ def print_summary(ingest_response: dict, execution_result: dict):
     execution_id = ingest_response["execution_id"]
     execution_result = poll_execution(BASE_URL, execution_id)
 
-    # Step 3: Summary
+    # Step 3: Fetch results
+    final_status = execution_result.get("status", "unknown")
+    if final_status == "completed":
+        results = fetch_results(BASE_URL, execution_id, save_dir=INPUT_DIR)
+    else:
+        print()
+        print(f"  Skipping results fetch — execution status is '{final_status}'")
+
+    # Step 4: Summary
     print_summary(ingest_response, execution_result)

From 3ad2862a725fcf4db11fc2a709ee4870d6020fde Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Fri, 15 May 2026 12:28:21 +0000
Subject: [PATCH 08/28] Refactor ingest API and relocate integration test

---
 contentflow-api/app/models/_ingest.py         |  5 ---
 contentflow-api/app/routers/ingest.py         | 28 +++++++--------
 .../app/services/ingest_service.py            | 10 ------
 contentflow-api/app/settings.py               |  1 +
 .../integration}/test_ingest_api.py           | 35 +++++++------------
 5 files changed, 26 insertions(+), 53 deletions(-)
 rename {contentflow-api/seed => tests/integration}/test_ingest_api.py (91%)

diff --git a/contentflow-api/app/models/_ingest.py b/contentflow-api/app/models/_ingest.py
index 6dc9379..426872b 100644
--- a/contentflow-api/app/models/_ingest.py
+++ b/contentflow-api/app/models/_ingest.py
@@ -12,11 +12,6 @@ class IngestPayload(BaseModel):
     lastName: str
     mailingAddress: str
     dateOfBirth: str
-    dateOfDeath: Optional[str] = ""
-    fatherFirstName: Optional[str] = ""
-    fatherLastName: Optional[str] = ""
-    motherFirstName: Optional[str] = ""
-    motherLastName: Optional[str] = ""
 
 
 class IngestResponse(BaseModel):
diff --git a/contentflow-api/app/routers/ingest.py b/contentflow-api/app/routers/ingest.py
index 2a97bcf..3a7397f 100644
--- a/contentflow-api/app/routers/ingest.py
+++ b/contentflow-api/app/routers/ingest.py
@@ -36,13 +36,6 @@ async def ingest_documents(
     last_name: str = Form(..., alias="lastName"),
     mailing_address: str = Form(..., alias="mailingAddress"),
     date_of_birth: str = Form(..., alias="dateOfBirth"),
-    date_of_death: Optional[str] = Form("", alias="dateOfDeath"),
-    father_first_name: Optional[str] = Form("", alias="fatherFirstName"),
-    father_last_name: Optional[str] = Form("", alias="fatherLastName"),
-    mother_first_name: Optional[str] = Form("", alias="motherFirstName"),
-    mother_last_name: Optional[str] = Form("", alias="motherLastName"),
-    # Pipeline
-    pipeline_id: str = Form(..., description="Pipeline ID to execute"),
     # Files
     files: List[UploadFile] = File(..., description="Document files to process"),
     # Dependencies
@@ -106,12 +99,20 @@ async def ingest_documents(
             detail=f"Total upload size exceeds maximum of {settings.INGEST_MAX_TOTAL_SIZE_MB} MB.",
         )
 
-    # --- Validate pipeline ---
-    pipeline = await pipeline_service.get_pipeline_by_id(pipeline_id)
+    # --- Resolve pipeline by name (abstracted from client) ---
+    pipeline_name = settings.INGEST_PIPELINE_NAME
+    pipeline = await pipeline_service.get_pipeline_by_name(pipeline_name)
     if not pipeline:
-        raise HTTPException(status_code=404, detail="Pipeline not found.")
+        logger.error(f"Ingest pipeline not found by name: '{pipeline_name}'")
+        raise HTTPException(
+            status_code=503,
+            detail="Processing pipeline is not available. Please contact support.",
+        )
     if not pipeline.enabled:
-        raise HTTPException(status_code=400, detail="Pipeline is disabled.")
+        raise HTTPException(
+            status_code=503,
+            detail="Processing pipeline is temporarily disabled. Please try again later.",
+        )
 
     # --- Create execution record first (to get execution_id for folder name) ---
     try:
@@ -135,11 +136,6 @@ async def ingest_documents(
         lastName=last_name,
         mailingAddress=mailing_address,
         dateOfBirth=date_of_birth,
-        dateOfDeath=date_of_death or "",
-        fatherFirstName=father_first_name or "",
-        fatherLastName=father_last_name or "",
-        motherFirstName=mother_first_name or "",
-        motherLastName=mother_last_name or "",
     )
 
     # --- Upload files and ProvidedDetails.json ---
diff --git a/contentflow-api/app/services/ingest_service.py b/contentflow-api/app/services/ingest_service.py
index 18c7301..f77d668 100644
--- a/contentflow-api/app/services/ingest_service.py
+++ b/contentflow-api/app/services/ingest_service.py
@@ -65,16 +65,6 @@ def generate_provided_details(self, payload: IngestPayload) -> bytes:
             "Address": payload.mailingAddress,
             "BirthDate": payload.dateOfBirth,
         }
-        if payload.dateOfDeath:
-            details["dateOfDeath"] = payload.dateOfDeath
-        if payload.fatherFirstName:
-            details["FatherFirstName"] = payload.fatherFirstName
-        if payload.fatherLastName:
-            details["FatherLastName"] = payload.fatherLastName
-        if payload.motherFirstName:
-            details["MotherFirstName"] = payload.motherFirstName
-        if payload.motherLastName:
-            details["MotherLastName"] = payload.motherLastName
 
         provided_details = {
             "caseId": payload.caseId,
diff --git a/contentflow-api/app/settings.py b/contentflow-api/app/settings.py
index 7af7059..06bbf0a 100644
--- a/contentflow-api/app/settings.py
+++ b/contentflow-api/app/settings.py
@@ -65,6 +65,7 @@ class AppSettings(BaseModel):
     WORKER_ENGINE_API_ENDPOINT: str = "http://localhost:8099"
 
     # Ingest API settings
+    INGEST_PIPELINE_NAME: str = "Details extraction and validation pipeline"
     INGEST_MAX_FILE_COUNT: int = 20
     INGEST_MAX_FILE_SIZE_MB: int = 100
     INGEST_MAX_TOTAL_SIZE_MB: int = 500
diff --git a/contentflow-api/seed/test_ingest_api.py b/tests/integration/test_ingest_api.py
similarity index 91%
rename from contentflow-api/seed/test_ingest_api.py
rename to tests/integration/test_ingest_api.py
index f633eed..45eb4bf 100644
--- a/contentflow-api/seed/test_ingest_api.py
+++ b/tests/integration/test_ingest_api.py
@@ -43,7 +43,9 @@
 
 # A valid pipeline ID from Cosmos DB that is enabled and linked to the
 # blob input discovery → content understanding → document validation flow.
-PIPELINE_ID = os.environ.get("CONTENTFLOW_PIPELINE_ID", "draft_details_extraction_and_validation_pipeline_d0e4eeb7")
+# NOTE: pipeline_id is no longer sent by the client — the API resolves it
+# internally by name. This variable is kept only for display/reference.
+PIPELINE_ID = os.environ.get("CONTENTFLOW_PIPELINE_ID", "resolved-server-side")
 
 # Folder containing the test documents to upload (PDFs, images, etc.)
 INPUT_DIR = os.environ.get("CONTENTFLOW_INPUT_DIR", os.path.join(os.path.dirname(__file__), "input"))
@@ -57,15 +59,10 @@
 # ──────────────────────────────────────────────
 CASE_DATA = {
     "caseId": "20261117254",
-    "firstName": "JONATHAN",
-    "lastName": "DIAZ CARTAGENA",
-    "mailingAddress": "URB PRADERA A-K5 CALLE 8, Toa Baja PR 00949",
-    "dateOfBirth": "2010-11-12",
-    # "dateOfDeath": "",
-    # "fatherFirstName": "Juan",
-    # "fatherLastName": "Orozco",
-    # "motherFirstName": "Maria",
-    # "motherLastName": "Dones",
+    "firstName": "ESTERBINA",
+    "lastName": "SIERRA RIOS",
+    "mailingAddress": "BO CIALITOS CRUCE CARR 608 KM 60 141 CIALES. PR 00638",
+    "dateOfBirth": "1983-03-16",
 }
 
 
@@ -91,15 +88,17 @@ def collect_files(input_dir: str) -> list[str]:
     return files
 
 
-def submit_ingest(base_url: str, pipeline_id: str, case_data: dict, file_paths: list[str]) -> dict:
+def submit_ingest(base_url: str, case_data: dict, file_paths: list[str]) -> dict:
     """
     POST /api/ingest — multipart form data with case fields + files.
+    Pipeline is resolved server-side by name (not sent by client).
     Returns the parsed JSON response (IngestResponse).
     """
     url = f"{base_url}/api/ingest/"
 
     # Build form fields (sent as multipart form data, not JSON)
-    form_data = {**case_data, "pipeline_id": pipeline_id}
+    # NOTE: pipeline_id is NOT sent — the API resolves the pipeline internally by name
+    form_data = {**case_data}
 
     # Build file tuples: ("files", (filename, file_handle, content_type))
     file_handles = []
@@ -114,7 +113,7 @@ def submit_ingest(base_url: str, pipeline_id: str, case_data: dict, file_paths:
     print("STEP 1 — Submitting ingest request")
     print("=" * 60)
     print(f"  URL:         {url}")
-    print(f"  Pipeline:    {pipeline_id}")
+    print(f"  Pipeline:    (resolved server-side by name)")
     print(f"  Case ID:     {case_data['caseId']}")
     print(f"  Files ({len(file_paths)}):")
     for p in file_paths:
@@ -315,19 +314,11 @@ def fetch_results(base_url: str, execution_id: str, save_dir: str = None) -> dic
         sys.exit(0)
 
     # ── Full mode: POST + poll + GET results ──
-    if PIPELINE_ID == "<YOUR_PIPELINE_ID>":
-        print("ERROR: Set PIPELINE_ID to a valid pipeline ID before running.")
-        print("       Either edit this file or set CONTENTFLOW_PIPELINE_ID env var.")
-        print()
-        print("       Find pipeline IDs via:")
-        print(f"         GET {BASE_URL}/api/pipelines/")
-        sys.exit(1)
-
     # Collect document files from input folder
     file_paths = collect_files(INPUT_DIR)
 
     # Step 1: Submit ingest
-    ingest_response = submit_ingest(BASE_URL, PIPELINE_ID, CASE_DATA, file_paths)
+    ingest_response = submit_ingest(BASE_URL, CASE_DATA, file_paths)
 
     # Step 2: Poll until complete
     execution_id = ingest_response["execution_id"]

From 2f3db8c53d03d49e1b635ad4d4fc480897e63353 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Mon, 18 May 2026 11:23:44 +0000
Subject: [PATCH 09/28] Updated address matching and openAI API call condition
 for validating the match.

---
 .../executors/document_validation_executor.py | 33 ++++++++++++++++---
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/contentflow-lib/contentflow/executors/document_validation_executor.py b/contentflow-lib/contentflow/executors/document_validation_executor.py
index 13d5fd3..b58d1d7 100644
--- a/contentflow-lib/contentflow/executors/document_validation_executor.py
+++ b/contentflow-lib/contentflow/executors/document_validation_executor.py
@@ -145,7 +145,7 @@ def __init__(
         self.openai_deployment_name = self.get_setting("deployment_name", default=None)
         self.openai_credential_type = self.get_setting("credential_type", default="default_azure_credential")
         self.openai_api_key = self.get_setting("api_key", default=None)
-        self.temperature = self.get_setting("temperature", default=0.1)
+        self.temperature = self.get_setting("temperature", default=0.0)
 
         # Validate OpenAI credential config
         if self.openai_credential_type not in ["default_azure_credential", "azure_key_credential"]:
@@ -923,16 +923,26 @@ async def _check_address_match(
         if region and region not in fetched_value:
             full_fetched_address = f"{fetched_value}, {region}"
 
+        # Normalize whitespace (newlines, tabs, multiple spaces) before comparison
+        normalized_fetched = self._normalize_address(str(full_fetched_address))
+        normalized_provided = self._normalize_address(str(provided_value))
+
+        # Short-circuit: if normalized addresses are an exact match, skip OpenAI
+        nf = normalized_fetched.upper() if not self.case_sensitive else normalized_fetched
+        np_ = normalized_provided.upper() if not self.case_sensitive else normalized_provided
+        if nf == np_:
+            return
+
         # Use AI-powered comparison if endpoint is configured
         if self.openai_endpoint and self.openai_deployment_name:
-            is_match = await self._ai_address_match(full_fetched_address, str(provided_value))
+            is_match = await self._ai_address_match(normalized_fetched, normalized_provided)
             if not is_match:
                 result["result"] = "fail"
                 result["message_en"] = validation.get("message_en")
                 result["message_es"] = validation.get("message_es")
         else:
             # Fallback to basic string comparison
-            if not self._values_match(str(full_fetched_address), str(provided_value)):
+            if not self._values_match(normalized_fetched, normalized_provided):
                 result["result"] = "fail"
                 result["message_en"] = validation.get("message_en")
                 result["message_es"] = validation.get("message_es")
@@ -964,6 +974,13 @@ async def _ai_address_match(self, address1: str, address2: str) -> bool:
                         f"confidence: {confidence}, reason: {parsed.get('reason', '')}"
                     )
 
+                # Use confidence threshold to recover borderline cases
+                if not match_result and confidence >= 0.75:
+                    logger.info(
+                        f"{self.id}: Overriding match=false with high confidence {confidence}"
+                    )
+                    return True
+
                 return bool(match_result)
             except json.JSONDecodeError:
                 # If response isn't valid JSON, look for keywords
@@ -977,12 +994,18 @@ async def _ai_address_match(self, address1: str, address2: str) -> bool:
             )
             return self._values_match(address1, address2)
 
+    def _normalize_address(self, address: str) -> str:
+        """Normalize whitespace in address strings (replace newlines, tabs, multiple spaces with single space)."""
+        import re
+        return re.sub(r'\s+', ' ', address).strip()
+
     def _values_match(self, fetched: str, provided: str) -> bool:
         """Compare two string values with normalization."""
         if not fetched or not provided:
             return False
-        f = fetched.strip()
-        p = provided.strip()
+        import re
+        f = re.sub(r'\s+', ' ', fetched).strip()
+        p = re.sub(r'\s+', ' ', provided).strip()
         if not self.case_sensitive:
             f = f.upper()
             p = p.upper()

From ec9a5be9170718ae316b466b060daccee36c1dc4 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Tue, 19 May 2026 12:58:59 +0000
Subject: [PATCH 10/28] updated code to save FetchedDetails jsons in same input
 folder

---
 .../seed/pipelines/draft-fetched-details-pipeline.yaml        | 4 ++--
 .../contentflow/executors/azure_blob_output_executor.py       | 3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
index f45c3ca..c1eb75e 100644
--- a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
+++ b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
@@ -8,7 +8,7 @@ pipeline:
       name: Discover Input Files
       type: azure_blob_input_discovery
       position:
-        x: 405
+        x: 409
         'y': 61
       description: >-
         Discovers and lists content files from Azure Blob Storage containers. Must be used with an Azure Blob Content
@@ -211,7 +211,7 @@ pipeline:
         credential_type: default_azure_credential
         credential_key: ''
         container_name: content
-        path_template: Fetched_Details/{execution_id}/
+        path_template: '{case_prefix}'
         filename_template: FetchedDetails_{id.unique_id}_{timestamp}.json
         content_field: document_record
         metadata_fields: ''
diff --git a/contentflow-lib/contentflow/executors/azure_blob_output_executor.py b/contentflow-lib/contentflow/executors/azure_blob_output_executor.py
index 116473d..b796053 100644
--- a/contentflow-lib/contentflow/executors/azure_blob_output_executor.py
+++ b/contentflow-lib/contentflow/executors/azure_blob_output_executor.py
@@ -246,8 +246,7 @@ def _format_template(self, template: str, content: Content) -> str:
         for field_path in matches:
             value = self._get_nested_value(source_data, field_path)
             if value is not None:
-                # Convert to string, handling special characters
-                str_value = str(value).replace('/', '_').replace('\\', '_')
+                str_value = str(value)
                 result = result.replace(f'{{{field_path}}}', str_value)
             else:
                 # Replace with 'unknown' if field not found

From 3f9b9b5179186726becbb6a52ff0295eb8719a26 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Fri, 22 May 2026 16:35:58 +0000
Subject: [PATCH 11/28] Added filename in results json and corrected
 unrecognized document type category in results json.

---
 .../draft-fetched-details-pipeline.yaml        |  5 ++---
 .../executors/document_validation_executor.py  | 18 ++++++++++--------
 2 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
index c1eb75e..200f476 100644
--- a/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
+++ b/contentflow-api/seed/pipelines/draft-fetched-details-pipeline.yaml
@@ -174,14 +174,13 @@ pipeline:
         object_mappings: |-
           {
             "document_record": {
-              "document_id": "id.canonical_id",
-              "filename": "id.filename",
+              "filename": "_filename",
               "document_type": "classification.category",
               "confidence": "classification.confidence",
               "details": "extracted_details"
             }
           }
-        source_id_mappings: ''
+        source_id_mappings: '{"_filename": "id.filename"}'
         copy_mode: copy
         create_nested: true
         overwrite_existing: true
diff --git a/contentflow-lib/contentflow/executors/document_validation_executor.py b/contentflow-lib/contentflow/executors/document_validation_executor.py
index b58d1d7..a34d233 100644
--- a/contentflow-lib/contentflow/executors/document_validation_executor.py
+++ b/contentflow-lib/contentflow/executors/document_validation_executor.py
@@ -582,6 +582,7 @@ async def _run_validation(
                 "totalDocuments": 0,
                 "passed": 0,
                 "failed": 0,
+                "invalid": 0,
                 "warnings": 0,
                 "notFound": 0,
                 "overallStatus": "passed"
@@ -612,6 +613,7 @@ async def _run_validation(
             fetched_doc_type = fetched.get("document_type", "")
             doc_result = {
                 "documentType": fetched_doc_type,
+                "filename": fetched.get("filename", ""),
                 "status": "passed",
                 "errors": [],
                 "fieldResults": []
@@ -638,14 +640,14 @@ async def _run_validation(
             # Find matching rules
             validations = self._find_matching_rules(fetched_doc_type, rules_by_type)
             if not validations:
-                # No rules means no validation needed - pass through
-                doc_result["status"] = "passed"
-                doc_result["fieldResults"].append({
-                    "field": "_meta",
-                    "result": "skipped",
-                    "message_en": f"No validation rules defined for document type '{fetched_doc_type}'."
+                # No rules — document type is not recognized or has no validation rules
+                doc_result["status"] = "invalid"
+                doc_result["errors"].append({
+                    "errorCode": "UNRECOGNIZED_DOCUMENT",
+                    "message_en": f"Document type '{fetched_doc_type}' could not be validated — no matching rules.",
+                    "message_es": f"El tipo de documento '{fetched_doc_type}' no pudo ser validado — sin reglas coincidentes."
                 })
-                results["summary"]["passed"] += 1
+                results["summary"]["invalid"] += 1
                 results["documentResults"].append(doc_result)
                 continue
 
@@ -677,7 +679,7 @@ async def _run_validation(
             results["documentResults"].append(doc_result)
 
         # Set overall status
-        if results["summary"]["failed"] > 0 or results["summary"]["notFound"] > 0:
+        if results["summary"]["failed"] > 0 or results["summary"]["notFound"] > 0 or results["summary"]["invalid"] > 0:
             results["summary"]["overallStatus"] = "failed"
 
         return results

From 7254783b0c930bcfa2f364f4989bed394cc52413 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Sat, 23 May 2026 17:58:57 +0000
Subject: [PATCH 12/28] updated main bicep and get-ailz-resource.sh to fetch
 correct details and skip validation for cae dns

---
 infra/bicep/main.bicep              | 3 ++-
 infra/scripts/get-ailz-resources.sh | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index efd4750..1a35fb3 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -117,7 +117,8 @@ var ailzValidation = isAILZIntegrated ? {
   cosmosPrivateDnsZoneRequired: !empty(existingCosmosPrivateDnsZoneId) ?? fail('existingCosmosPrivateDnsZoneId is required for ailz-integrated mode')
   appConfigPrivateDnsZoneRequired: !empty(existingAppConfigPrivateDnsZoneId) ?? fail('existingAppConfigPrivateDnsZoneId is required for ailz-integrated mode')
   acrPrivateDnsZoneRequired: !empty(existingAcrPrivateDnsZoneId) ?? fail('existingAcrPrivateDnsZoneId is required for ailz-integrated mode')
-  containerAppsEnvPrivateDnsZoneRequired: !empty(existingContainerAppsEnvPrivateDnsZoneId) ?? fail('existingContainerAppsEnvPrivateDnsZoneId is required for ailz-integrated mode')
+  // CAE DNS zone is NOT validated here — it is created dynamically by cae-dns-zone.bicep
+  // using the CAE's defaultDomain and staticIp after provisioning. No pre-existing zone needed.
 } : {}
 
 // ========== VARIABLES ==========
diff --git a/infra/scripts/get-ailz-resources.sh b/infra/scripts/get-ailz-resources.sh
index 2ce21eb..89d1f56 100755
--- a/infra/scripts/get-ailz-resources.sh
+++ b/infra/scripts/get-ailz-resources.sh
@@ -151,7 +151,7 @@ if [ ! -z "$VNET_NAME" ]; then
     fi
 
     echo -n "Searching for Container Apps Environment Subnet..."
-    ACA_SUBNET=$(az network vnet subnet list --resource-group $AILZ_RG --vnet-name "$VNET_NAME" --query "[?name=='aca-env-subnet'].name" -o tsv)
+    ACA_SUBNET=$(az network vnet subnet list --resource-group $AILZ_RG --vnet-name "$VNET_NAME" --query "[?name=='aca-env-subnet' || name=='aca-environment-subnet' || contains(name, 'aca')].name" -o tsv | head -n1)
     if [ ! -z "$ACA_SUBNET" ]; then
         echo " FOUND ✓"
         echo "CONTAINER_APPS_SUBNET_NAME=\"$ACA_SUBNET\"" >> $OUTPUT_FILE

From 223ef7c7d8a70c3bf2e3028e71a1710677d113b3 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Mon, 25 May 2026 16:32:17 +0000
Subject: [PATCH 13/28] chore: disable worker container app deployment

Comment out (not remove) all worker-related infrastructure:
- Worker container app module and params in main.bicep
- Worker App Config keys and queue App Config keys
- WORKER_ENGINE_API_ENDPOINT env var from API container app
- Worker service definition in azure.yaml
- Queue creation in post-provision.sh
- Worker endpoint output in post-deploy.sh

All sections marked with 'WORKER DISABLED' for easy re-enablement.
API executes pipelines directly via background asyncio tasks.
---
 azure.yaml                      | 22 ++++++++++++----------
 infra/bicep/main.bicep          | 16 +++++++++++++---
 infra/scripts/post-deploy.sh    |  4 ++--
 infra/scripts/post-provision.sh | 16 +++++++++-------
 4 files changed, 36 insertions(+), 22 deletions(-)

diff --git a/azure.yaml b/azure.yaml
index c6043c4..ab4e0de 100644
--- a/azure.yaml
+++ b/azure.yaml
@@ -24,16 +24,18 @@ services:
       target: ""
       remoteBuild: false
 
-  # ContentFlow Worker - Container App
-  worker:
-    project: ./contentflow-worker
-    language: python
-    host: containerapp
-    docker:
-      path: ./Dockerfile
-      context: ..
-      target: ""
-      remoteBuild: false
+  # --- WORKER DISABLED: uncomment to re-enable worker deployment ---
+  # # ContentFlow Worker - Container App
+  # worker:
+  #   project: ./contentflow-worker
+  #   language: python
+  #   host: containerapp
+  #   docker:
+  #     path: ./Dockerfile
+  #     context: ..
+  #     target: ""
+  #     remoteBuild: false
+  # --- END WORKER DISABLED ---
 
   # ContentFlow Web - Container App
   web:
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index 1a35fb3..54afeaa 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -93,6 +93,7 @@ param docsContainerName string = 'content'
 @description('API Container App target port')
 param apiContainerAppTargetPort int = 8090
 
+/* --- WORKER DISABLED: uncomment to re-enable worker container app ---
 @description('Worker Container App target port')
 param workerContainerAppTargetPort int = 8099
 
@@ -101,6 +102,7 @@ param workerAPIEnabled bool = true
 
 @description('Queue name for worker tasks')
 param workerQueueName string = 'contentflow-execution-requests'
+--- END WORKER DISABLED */
 
 // ========== DEPLOYMENT MODE VALIDATION ==========
 var isBasic = deploymentMode == 'basic'
@@ -162,7 +164,7 @@ var appConfigStoreName = 'appcs-${resourceToken}'
 var containerRegistryName = 'cr${resourceToken}'
 var containerAppsEnvironmentName = 'cae-${resourceToken}'
 var apiContainerAppName = 'api-${resourceToken}'
-var workerContainerAppName = 'worker-${resourceToken}'
+// WORKER DISABLED: var workerContainerAppName = 'worker-${resourceToken}'
 var webContainerAppName = 'web-${resourceToken}'
 
 // ========== MODULES DEPLOYMENT =========
@@ -319,6 +321,7 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         name: 'contentflow.common.BLOB_STORAGE_CONTAINER_NAME'
         value: docsContainerName
       }
+      /* WORKER DISABLED: uncomment to re-enable queue App Config keys
       {
         contentType: 'text/plain'
         name: 'contentflow.common.STORAGE_ACCOUNT_WORKER_QUEUE_URL'
@@ -329,6 +332,7 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         name: 'contentflow.common.STORAGE_WORKER_QUEUE_NAME'
         value: workerQueueName
       }
+      */
       // API settings
       {
         contentType: 'text/plain'
@@ -371,6 +375,7 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         value: '*'
       }
       // NOTE: WORKER_ENGINE_API_ENDPOINT moved to apiContainerApp env vars to break circular dependency
+      /* --- WORKER DISABLED: uncomment to re-enable worker App Config keys ---
       // Worker settings
       {
         contentType: 'text/plain'
@@ -447,6 +452,7 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         name: 'contentflow.worker.LOCK_TTL_SECONDS'
         value: '300'
       }
+      --- END WORKER DISABLED */
       {
         contentType: 'text/plain'
         name: 'sentinel'
@@ -562,10 +568,12 @@ module apiContainerApp 'modules/container-app.bicep' = {
         name: 'AZURE_CLIENT_ID'
         value: userAssignedIdentity.outputs.clientId
       }
+      /* WORKER DISABLED: uncomment to re-enable worker endpoint
       {
         name: 'WORKER_ENGINE_API_ENDPOINT'
         value: 'https://${workerContainerApp.outputs.fqdn}'
       }
+      */
       {
         name: 'AZURE_STORAGE_ACCOUNT_NAME'
         value: storageAccountName
@@ -583,6 +591,7 @@ module apiContainerApp 'modules/container-app.bicep' = {
   }
 }
 
+/* --- WORKER DISABLED: uncomment to re-enable worker container app ---
 // ========== WORKER CONTAINER APP ==========
 module workerContainerApp 'modules/container-app.bicep' = {
   name: 'ca-worker-${resourceToken}'
@@ -629,6 +638,7 @@ module workerContainerApp 'modules/container-app.bicep' = {
     tags: union(tags, { 'azd-service-name': 'worker' })
   }
 }
+--- END WORKER DISABLED */
 
 // ========== WEB CONTAINER APP ==========
 module webContainerApp 'modules/container-app.bicep' = {
@@ -669,7 +679,7 @@ output AZURE_CONTAINER_REGISTRY_NAME string = containerRegistry.outputs.name
 
 // Service endpoints
 output API_ENDPOINT string = 'https://${apiContainerApp.outputs.fqdn}'
-output WORKER_ENDPOINT string = 'https://${workerContainerApp.outputs.fqdn}'
+// WORKER DISABLED: output WORKER_ENDPOINT string = 'https://${workerContainerApp.outputs.fqdn}'
 output WEB_ENDPOINT string = 'https://${webContainerApp.outputs.fqdn}'
 
 // Resource outputs
@@ -677,7 +687,7 @@ output COSMOS_DB_ENDPOINT string = cosmos.outputs.cosmosEndpoint
 output COSMOS_DB_NAME string = cosmosDbName
 output STORAGE_ACCOUNT_NAME string = storage.outputs.name
 output STORAGE_QUEUE_URL string = storage.outputs.primaryQueueEndpoint
-output STORAGE_QUEUE_NAME string = workerQueueName
+// WORKER DISABLED: output STORAGE_QUEUE_NAME string = workerQueueName
 output APP_CONFIG_ENDPOINT string = appConfigStore.outputs.endpoint
 output APPLICATIONINSIGHTS_CONNECTION_STRING string = appInsightsConnectionString
 
diff --git a/infra/scripts/post-deploy.sh b/infra/scripts/post-deploy.sh
index 68bc335..acda17f 100755
--- a/infra/scripts/post-deploy.sh
+++ b/infra/scripts/post-deploy.sh
@@ -10,7 +10,7 @@ echo "=================================================="
 # Get deployment outputs
 API_ENDPOINT=$(azd env get-value API_ENDPOINT 2>/dev/null || echo "Not available")
 WEB_ENDPOINT=$(azd env get-value WEB_ENDPOINT 2>/dev/null || echo "Not available")
-WORKER_ENDPOINT=$(azd env get-value WORKER_ENDPOINT 2>/dev/null || echo "Not available")
+# WORKER DISABLED: WORKER_ENDPOINT=$(azd env get-value WORKER_ENDPOINT 2>/dev/null || echo "Not available")
 
 echo ""
 echo "╔════════════════════════════════════════════════╗"
@@ -20,7 +20,7 @@ echo ""
 echo "Service Endpoints:"
 echo "  API:    $API_ENDPOINT"
 echo "  Web:    $WEB_ENDPOINT"
-echo "  Worker: $WORKER_ENDPOINT"
+# WORKER DISABLED: echo "  Worker: $WORKER_ENDPOINT"
 echo ""
 
 # ========== SECURITY HARDENING (AILZ mode only) ==========
diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index fabbc7f..e3dd011 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -17,13 +17,15 @@ echo "Resource Group: $RESOURCE_GROUP"
 echo "Storage Account: $STORAGE_ACCOUNT"
 echo "Cosmos DB Endpoint: $COSMOS_ENDPOINT"
 
-echo "✓ Creating storage queue (if not exists)..."
-QUEUE_NAME="contentflow-execution-requests"
-az storage queue create \
-  --name "$QUEUE_NAME" \
-  --account-name "$STORAGE_ACCOUNT" \
-  --auth-mode login \
-  --only-show-errors || echo "Queue already exists or error creating queue"
+# --- WORKER DISABLED: uncomment to re-enable queue creation ---
+# echo "✓ Creating storage queue (if not exists)..."
+# QUEUE_NAME="contentflow-execution-requests"
+# az storage queue create \
+#   --name "$QUEUE_NAME" \
+#   --account-name "$STORAGE_ACCOUNT" \
+#   --auth-mode login \
+#   --only-show-errors || echo "Queue already exists or error creating queue"
+# --- END WORKER DISABLED ---
 
 # ========== CONTENT UNDERSTANDING SETUP ==========
 echo ""

From 4f96c1084ef6513154336fc156cb59ee001ad18b Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Mon, 25 May 2026 16:51:01 +0000
Subject: [PATCH 14/28] fix: reduce text-embedding-3-large capacity from 100 to
 70 for quota limits

---
 infra/bicep/modules/ai-foundry.bicep | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep
index 8fdb66c..0ef292a 100644
--- a/infra/bicep/modules/ai-foundry.bicep
+++ b/infra/bicep/modules/ai-foundry.bicep
@@ -73,7 +73,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         }
         name: 'text-embedding-3-large'
         sku: {
-          capacity: 100
+          capacity: 70
           name: 'Standard'
         }
       }

From fa38a23e54655aeb1cd08640dad90e81dcf47da0 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Tue, 26 May 2026 09:29:02 +0000
Subject: [PATCH 15/28] fix: populate pipeline nodes and edges from YAML during
 seeding

Parse executors and edges from seed YAML into the nodes/edges arrays
that the ReactFlow canvas uses for rendering. Previously these were
hardcoded to empty arrays, causing blank canvas and empty YAML tab
on seeded pipelines.
---
 contentflow-api/app/dependencies.py | 43 +++++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/contentflow-api/app/dependencies.py b/contentflow-api/app/dependencies.py
index e82be60..60bd1b4 100644
--- a/contentflow-api/app/dependencies.py
+++ b/contentflow-api/app/dependencies.py
@@ -219,12 +219,51 @@ async def initialize_seed_pipelines():
                 with open(yaml_path, "r") as f:
                     yaml_str = f.read()
 
+                # Parse executors from YAML into nodes for canvas visualization
+                executors = pipeline_def.get("executors", [])
+                nodes = []
+                for executor in executors:
+                    nodes.append({
+                        "id": executor.get("id", ""),
+                        "type": "executor",
+                        "position": executor.get("position", {"x": 0, "y": 0}),
+                        "data": {
+                            "label": executor.get("name", ""),
+                            "executor": {
+                                "id": executor.get("type", ""),
+                                "name": executor.get("name", ""),
+                                "category": "unknown",
+                                "description": executor.get("description", ""),
+                            },
+                            "config": {
+                                "name": executor.get("name", ""),
+                                "description": executor.get("description", ""),
+                                "settings": executor.get("settings", {}),
+                            },
+                        },
+                    })
+
+                # Parse edges from YAML for canvas connections
+                yaml_edges = pipeline_def.get("edges", [])
+                edges = []
+                for edge_def in yaml_edges:
+                    src = edge_def.get("from", "")
+                    tgt = edge_def.get("to", "")
+                    if isinstance(src, str) and isinstance(tgt, str):
+                        edges.append({
+                            "id": f"{src}-{tgt}-{len(edges)}",
+                            "source": src,
+                            "target": tgt,
+                            "type": "default",
+                            "animated": True,
+                        })
+
                 pipeline_data = {
                     "name": name,
                     "description": pipeline_def.get("description", ""),
                     "yaml": yaml_str,
-                    "nodes": [],
-                    "edges": pipeline_def.get("edges", []),
+                    "nodes": nodes,
+                    "edges": edges,
                     "tags": pipeline_def.get("tags", []),
                     "enabled": True,
                 }

From ff453c40ed463427f8839f4c12d2a95a62332abd Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Tue, 26 May 2026 11:26:49 +0000
Subject: [PATCH 16/28] Updated user role allocation for analyzer creation
 during deployment

---
 infra/bicep/main.json           | 51165 ++++++++++++++++++++++++++++++
 infra/scripts/post-provision.sh |    25 +-
 2 files changed, 51188 insertions(+), 2 deletions(-)
 create mode 100644 infra/bicep/main.json

diff --git a/infra/bicep/main.json b/infra/bicep/main.json
new file mode 100644
index 0000000..b5045cb
--- /dev/null
+++ b/infra/bicep/main.json
@@ -0,0 +1,51165 @@
+{
+  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+  "languageVersion": "2.0",
+  "contentVersion": "1.0.0.0",
+  "metadata": {
+    "_generator": {
+      "name": "bicep",
+      "version": "0.43.8.12551",
+      "templateHash": "17497183521137074818"
+    }
+  },
+  "parameters": {
+    "deploymentMode": {
+      "type": "string",
+      "allowedValues": [
+        "basic",
+        "ailz-integrated"
+      ],
+      "metadata": {
+        "description": "Deployment mode: basic (creates all networking) or ailz-integrated (uses existing AI Landing Zone)"
+      }
+    },
+    "environmentName": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 64,
+      "metadata": {
+        "description": "Name of the environment that can be used as part of naming resource convention"
+      }
+    },
+    "location": {
+      "type": "string",
+      "defaultValue": "[resourceGroup().location]",
+      "minLength": 1,
+      "metadata": {
+        "description": "Primary location for all resources, defaults to resource group location"
+      }
+    },
+    "foundryLocation": {
+      "type": "string",
+      "metadata": {
+        "description": "Location for AI Foundry resources"
+      }
+    },
+    "cosmosLocation": {
+      "type": "string",
+      "defaultValue": "[parameters('location')]",
+      "metadata": {
+        "description": "Location for Cosmos DB resources (override if primary region has capacity issues)"
+      }
+    },
+    "existingOpenAIResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of an existing Azure OpenAI resource for RBAC assignment (if not using AI Foundry integrated endpoint)"
+      }
+    },
+    "principalId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "ID of the user running the deployment"
+      }
+    },
+    "existingVnetResourceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing AI Landing Zone Virtual Network (required for ailz-integrated mode)"
+      }
+    },
+    "privateEndpointSubnetName": {
+      "type": "string",
+      "defaultValue": "pe-subnet",
+      "metadata": {
+        "description": "Name of the subnet for private endpoints in AI Landing Zone VNet (default: pe-subnet)"
+      }
+    },
+    "containerAppsSubnetName": {
+      "type": "string",
+      "defaultValue": "aca-env-subnet",
+      "metadata": {
+        "description": "Name of the subnet for container apps in AI Landing Zone VNet (default: aca-env-subnet)"
+      }
+    },
+    "existingCognitiveServicesPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Cognitive Services Private DNS Zone (required for ailz-integrated mode)"
+      }
+    },
+    "existingBlobPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Blob Storage Private DNS Zone (required for ailz-integrated mode)"
+      }
+    },
+    "existingQueuePrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Queue Storage Private DNS Zone (optional for ailz-integrated mode)"
+      }
+    },
+    "existingCosmosPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Cosmos DB Private DNS Zone (required for ailz-integrated mode)"
+      }
+    },
+    "existingAppConfigPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing App Config Private DNS Zone (required for ailz-integrated mode)"
+      }
+    },
+    "existingAcrPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Container Registry Private DNS Zone (required for ailz-integrated mode)"
+      }
+    },
+    "existingContainerAppsEnvPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Container Apps Environment Private DNS Zone (required for ailz-integrated mode)"
+      }
+    },
+    "existingKeyVaultPrivateDnsZoneId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Key Vault Private DNS Zone (optional)"
+      }
+    },
+    "existingLogAnalyticsWorkspaceId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing Log Analytics Workspace from AI Landing Zone (optional, will create new if not provided)"
+      }
+    },
+    "existingAppInsightsId": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Resource ID of existing App Insights from AI Landing Zone (optional, will create new if not provided)"
+      }
+    },
+    "cosmosDbName": {
+      "type": "string",
+      "defaultValue": "contentflow",
+      "metadata": {
+        "description": "Cosmos DB database name"
+      }
+    },
+    "cosmosDBContainerNames": {
+      "type": "array",
+      "defaultValue": [
+        {
+          "name": "executor_catalog",
+          "partitionKey": "/id"
+        },
+        {
+          "name": "pipelines",
+          "partitionKey": "/id"
+        },
+        {
+          "name": "vaults",
+          "partitionKey": "/id"
+        },
+        {
+          "name": "pipeline_executions",
+          "partitionKey": "/id"
+        },
+        {
+          "name": "vault_exec_locks",
+          "partitionKey": "/id"
+        },
+        {
+          "name": "vault_crawl_checkpoints",
+          "partitionKey": "/id"
+        },
+        {
+          "name": "vault_executions",
+          "partitionKey": "/id"
+        }
+      ],
+      "metadata": {
+        "description": "Cosmos DB container names to create"
+      }
+    },
+    "docsContainerName": {
+      "type": "string",
+      "defaultValue": "content",
+      "metadata": {
+        "description": "Name of the blob storage container for documents"
+      }
+    },
+    "apiContainerAppTargetPort": {
+      "type": "int",
+      "defaultValue": 8090,
+      "metadata": {
+        "description": "API Container App target port"
+      }
+    },
+    "workerContainerAppTargetPort": {
+      "type": "int",
+      "defaultValue": 8099,
+      "metadata": {
+        "description": "Worker Container App target port"
+      }
+    },
+    "workerAPIEnabled": {
+      "type": "bool",
+      "defaultValue": true,
+      "metadata": {
+        "description": "Enable API service in worker container app - used for health checks"
+      }
+    },
+    "workerQueueName": {
+      "type": "string",
+      "defaultValue": "contentflow-execution-requests",
+      "metadata": {
+        "description": "Queue name for worker tasks"
+      }
+    }
+  },
+  "variables": {
+    "isBasic": "[equals(parameters('deploymentMode'), 'basic')]",
+    "isAILZIntegrated": "[equals(parameters('deploymentMode'), 'ailz-integrated')]",
+    "ailzValidation": "[if(variables('isAILZIntegrated'), createObject('vnetRequired', coalesce(not(empty(parameters('existingVnetResourceId'))), fail('existingVnetResourceId is required for ailz-integrated mode')), 'peSubnetRequired', coalesce(not(empty(parameters('privateEndpointSubnetName'))), fail('privateEndpointSubnetName is required for ailz-integrated mode')), 'caSubnetRequired', coalesce(not(empty(parameters('containerAppsSubnetName'))), fail('containerAppsSubnetName is required for ailz-integrated mode')), 'cognitiveServicesPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingCognitiveServicesPrivateDnsZoneId'))), fail('existingCognitiveServicesPrivateDnsZoneId is required for ailz-integrated mode')), 'blobPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingBlobPrivateDnsZoneId'))), fail('existingBlobPrivateDnsZoneId is required for ailz-integrated mode')), 'cosmosPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingCosmosPrivateDnsZoneId'))), fail('existingCosmosPrivateDnsZoneId is required for ailz-integrated mode')), 'appConfigPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingAppConfigPrivateDnsZoneId'))), fail('existingAppConfigPrivateDnsZoneId is required for ailz-integrated mode')), 'acrPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingAcrPrivateDnsZoneId'))), fail('existingAcrPrivateDnsZoneId is required for ailz-integrated mode'))), createObject())]",
+    "tags": {
+      "azd-env-name": "[parameters('environmentName')]",
+      "application": "contentflow",
+      "deploymentMode": "[parameters('deploymentMode')]"
+    },
+    "resourceToken": "[uniqueString(resourceGroup().id, parameters('environmentName'), parameters('location'))]",
+    "networkConfig": "[if(variables('isAILZIntegrated'), createObject('enablePrivateEndpoints', true(), 'publicNetworkAccess', 'Disabled', 'vnetResourceId', parameters('existingVnetResourceId'), 'privateEndpointSubnetId', format('{0}/subnets/{1}', parameters('existingVnetResourceId'), parameters('privateEndpointSubnetName')), 'containerAppsSubnetId', format('{0}/subnets/{1}', parameters('existingVnetResourceId'), parameters('containerAppsSubnetName')), 'privateDnsZoneIds', createObject('cognitiveServices', parameters('existingCognitiveServicesPrivateDnsZoneId'), 'blob', parameters('existingBlobPrivateDnsZoneId'), 'queue', parameters('existingQueuePrivateDnsZoneId'), 'cosmos', parameters('existingCosmosPrivateDnsZoneId'), 'appConfig', parameters('existingAppConfigPrivateDnsZoneId'), 'acr', parameters('existingAcrPrivateDnsZoneId'), 'keyVault', parameters('existingKeyVaultPrivateDnsZoneId'), 'containerAppsEnv', parameters('existingContainerAppsEnvPrivateDnsZoneId'))), createObject('enablePrivateEndpoints', false(), 'publicNetworkAccess', 'Enabled'))]",
+    "userAssignedIdentityName": "[format('id-{0}', variables('resourceToken'))]",
+    "logAnalyticsWorkspaceName": "[format('log-{0}', variables('resourceToken'))]",
+    "appInsightsName": "[format('appi-{0}', variables('resourceToken'))]",
+    "storageAccountName": "[take(format('st{0}', variables('resourceToken')), 24)]",
+    "cosmosAccountName": "[format('cosmos-{0}', variables('resourceToken'))]",
+    "appConfigStoreName": "[format('appcs-{0}', variables('resourceToken'))]",
+    "containerRegistryName": "[format('cr{0}', variables('resourceToken'))]",
+    "containerAppsEnvironmentName": "[format('cae-{0}', variables('resourceToken'))]",
+    "apiContainerAppName": "[format('api-{0}', variables('resourceToken'))]",
+    "workerContainerAppName": "[format('worker-{0}', variables('resourceToken'))]",
+    "webContainerAppName": "[format('web-{0}', variables('resourceToken'))]",
+    "shouldCreateLogAnalytics": "[and(variables('isBasic'), empty(parameters('existingLogAnalyticsWorkspaceId')))]",
+    "shouldCreateAppInsights": "[and(variables('isBasic'), empty(parameters('existingAppInsightsId')))]",
+    "shouldCreateQueueDnsZone": "[and(variables('isAILZIntegrated'), empty(parameters('existingQueuePrivateDnsZoneId')))]"
+  },
+  "resources": {
+    "userAssignedIdentity": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('userAssignedIdentity-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "userAssignedIdentityName": {
+            "value": "[variables('userAssignedIdentityName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "1061071107834451110"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional: Location for all resources. Default is the resource group location"
+              }
+            },
+            "userAssignedIdentityName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required: User Assigned Identity name"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional: Tags for resources"
+              }
+            }
+          },
+          "resources": {
+            "userAssignedIdentity": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('userAssignedIdentity-{0}', uniqueString('userAssignedIdentity', deployment().name))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('userAssignedIdentityName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.34.44.8038",
+                      "templateHash": "16707109626832623586"
+                    },
+                    "name": "User Assigned Identities",
+                    "description": "This module deploys a User Assigned Identity."
+                  },
+                  "definitions": {
+                    "federatedIdentityCredentialType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the federated identity credential."
+                          }
+                        },
+                        "audiences": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The list of audiences that can appear in the issued token."
+                          }
+                        },
+                        "issuer": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The URL of the issuer to be trusted."
+                          }
+                        },
+                        "subject": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The identifier of the external identity."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the federated identity credential."
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the User Assigned Identity."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "federatedIdentityCredentials": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/federatedIdentityCredentialType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]",
+                      "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "userAssignedIdentity": {
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]"
+                    },
+                    "userAssignedIdentity_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "userAssignedIdentity"
+                      ]
+                    },
+                    "userAssignedIdentity_roleAssignments": {
+                      "copy": {
+                        "name": "userAssignedIdentity_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "userAssignedIdentity"
+                      ]
+                    },
+                    "userAssignedIdentity_federatedIdentityCredentials": {
+                      "copy": {
+                        "name": "userAssignedIdentity_federatedIdentityCredentials",
+                        "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-UserMSI-FederatedIdentityCred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]"
+                          },
+                          "userAssignedIdentityName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "audiences": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]"
+                          },
+                          "issuer": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]"
+                          },
+                          "subject": {
+                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "13656021764446440473"
+                            },
+                            "name": "User Assigned Identity Federated Identity Credential",
+                            "description": "This module deploys a User Assigned Identity Federated Identity Credential."
+                          },
+                          "parameters": {
+                            "userAssignedIdentityName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the secret."
+                              }
+                            },
+                            "audiences": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
+                              }
+                            },
+                            "issuer": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
+                              }
+                            },
+                            "subject": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
+                              "apiVersion": "2024-11-30",
+                              "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
+                              "properties": {
+                                "audiences": "[parameters('audiences')]",
+                                "issuer": "[parameters('issuer')]",
+                                "subject": "[parameters('subject')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the federated identity credential."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the federated identity credential."
+                              },
+                              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the federated identity credential was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "userAssignedIdentity"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the user assigned identity."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the user assigned identity."
+                      },
+                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
+                    },
+                    "principalId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The principal ID (object ID) of the user assigned identity."
+                      },
+                      "value": "[reference('userAssignedIdentity').principalId]"
+                    },
+                    "clientId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The client ID (application ID) of the user assigned identity."
+                      },
+                      "value": "[reference('userAssignedIdentity').clientId]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the user assigned identity was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('userAssignedIdentity', '2024-11-30', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "value": "[reference('userAssignedIdentity').outputs.name.value]"
+            },
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
+            },
+            "principalId": {
+              "type": "string",
+              "value": "[reference('userAssignedIdentity').outputs.principalId.value]"
+            },
+            "clientId": {
+              "type": "string",
+              "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
+            }
+          }
+        }
+      }
+    },
+    "logAnalytics": {
+      "condition": "[variables('shouldCreateLogAnalytics')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('logAnalytics-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "logAnalyticsWorkspaceName": {
+            "value": "[variables('logAnalyticsWorkspaceName')]"
+          },
+          "roleAssignedManagedIdentityPrincipalIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.principalId.value]"
+            ]
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "220699877648959996"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Location for all resources"
+              }
+            },
+            "logAnalyticsWorkspaceName": {
+              "type": "string",
+              "metadata": {
+                "description": "Log Analytics workspace name"
+              }
+            },
+            "roleAssignedManagedIdentityPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "User Assigned Identity that be given access to the Log Analytics Workspace"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "resources": {
+            "logAnalytics": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('logAnalytics-{0}', uniqueString('logAnalytics', deployment().name))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('logAnalyticsWorkspaceName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "skuName": {
+                    "value": "PerGB2018"
+                  },
+                  "dataRetention": {
+                    "value": 30
+                  },
+                  "roleAssignments": {
+                    "copy": [
+                      {
+                        "name": "value",
+                        "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                        "input": "[createObject('principalId', parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('value')], 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Log Analytics Contributor')]"
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.36.1.42791",
+                      "templateHash": "1749032521457140145"
+                    },
+                    "name": "Log Analytics Workspaces",
+                    "description": "This module deploys a Log Analytics Workspace."
+                  },
+                  "definitions": {
+                    "diagnosticSettingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "useThisWorkspace": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      }
+                    },
+                    "gallerySolutionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                          }
+                        },
+                        "plan": {
+                          "$ref": "#/definitions/solutionPlanType",
+                          "metadata": {
+                            "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the gallery solutions to be created in the log analytics workspace."
+                      }
+                    },
+                    "storageInsightsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the storage account to be linked."
+                          }
+                        },
+                        "containers": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The names of the blob containers that the workspace should read."
+                          }
+                        },
+                        "tables": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of tables to be read by the workspace."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the storage insights configuration."
+                      }
+                    },
+                    "linkedServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the linked service."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                          }
+                        },
+                        "writeAccessResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the linked service."
+                      }
+                    },
+                    "linkedStorageAccountType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the link."
+                          }
+                        },
+                        "storageAccountIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "minLength": 1,
+                          "metadata": {
+                            "description": "Required. Linked storage accounts resources Ids."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the linked storage account."
+                      }
+                    },
+                    "savedSearchType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the saved search."
+                          }
+                        },
+                        "etag": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                          }
+                        },
+                        "category": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The category of the saved search. This helps the user to find a saved search faster."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Display name for the search."
+                          }
+                        },
+                        "functionAlias": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The function alias if query serves as a function."
+                          }
+                        },
+                        "functionParameters": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                          }
+                        },
+                        "query": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The query expression for the saved search."
+                          }
+                        },
+                        "tags": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The tags attached to the saved search."
+                          }
+                        },
+                        "version": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version number of the query language. The current version is 2 and is the default."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the saved search."
+                      }
+                    },
+                    "dataExportType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the data export."
+                          }
+                        },
+                        "destination": {
+                          "$ref": "#/definitions/destinationType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination of the data export."
+                          }
+                        },
+                        "enable": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable the data export."
+                          }
+                        },
+                        "tableNames": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The list of table names to export."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the data export."
+                      }
+                    },
+                    "dataSourceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the data source."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The kind of data source."
+                          }
+                        },
+                        "linkedResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource id of the resource that will be linked to the workspace."
+                          }
+                        },
+                        "eventLogName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the event log to configure when kind is WindowsEvent."
+                          }
+                        },
+                        "eventTypes": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The event types to configure when kind is WindowsEvent."
+                          }
+                        },
+                        "objectName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                          }
+                        },
+                        "instanceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                          }
+                        },
+                        "intervalSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                          }
+                        },
+                        "performanceCounters": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                          }
+                        },
+                        "counterName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                          }
+                        },
+                        "state": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                          }
+                        },
+                        "syslogName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. System log to configure when kind is LinuxSyslog."
+                          }
+                        },
+                        "syslogSeverities": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to configure in the resource."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the data source."
+                      }
+                    },
+                    "tableType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the table."
+                          }
+                        },
+                        "plan": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The plan for the table."
+                          }
+                        },
+                        "restoredLogs": {
+                          "$ref": "#/definitions/restoredLogsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The restored logs for the table."
+                          }
+                        },
+                        "schema": {
+                          "$ref": "#/definitions/schemaType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The schema for the table."
+                          }
+                        },
+                        "searchResults": {
+                          "$ref": "#/definitions/searchResultsType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The search results for the table."
+                          }
+                        },
+                        "retentionInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The retention in days for the table."
+                          }
+                        },
+                        "totalRetentionInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The total retention in days for the table."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The role assignments for the table."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Properties of the custom table."
+                      }
+                    },
+                    "workspaceFeaturesType": {
+                      "type": "object",
+                      "properties": {
+                        "disableLocalAuth": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Disable Non-EntraID based Auth. Default is true."
+                          }
+                        },
+                        "enableDataExport": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Flag that indicate if data should be exported."
+                          }
+                        },
+                        "enableLogAccessUsingOnlyResourcePermissions": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable log access using only resource permissions. Default is false."
+                          }
+                        },
+                        "immediatePurgeDataOn30Days": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Flag that describes if we want to remove the data after 30 days."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Features of the workspace."
+                      }
+                    },
+                    "workspaceReplicationType": {
+                      "type": "object",
+                      "properties": {
+                        "enabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The location to which the workspace is replicated. Required if replication is enabled."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Replication properties of the workspace."
+                      }
+                    },
+                    "_1.columnType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The column name."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "boolean",
+                            "dateTime",
+                            "dynamic",
+                            "guid",
+                            "int",
+                            "long",
+                            "real",
+                            "string"
+                          ],
+                          "metadata": {
+                            "description": "Required. The column type."
+                          }
+                        },
+                        "dataTypeHint": {
+                          "type": "string",
+                          "allowedValues": [
+                            "armPath",
+                            "guid",
+                            "ip",
+                            "uri"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The column data type logical hint."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The column description."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Column display name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The parameters of the table column.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "destinationType": {
+                      "type": "object",
+                      "properties": {
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The destination resource ID."
+                          }
+                        },
+                        "metaData": {
+                          "type": "object",
+                          "properties": {
+                            "eventHubName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination metadata."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The data export destination properties.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "data-export/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "restoredLogsType": {
+                      "type": "object",
+                      "properties": {
+                        "sourceTable": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table to restore data from."
+                          }
+                        },
+                        "startRestoreTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to start the restore from (UTC)."
+                          }
+                        },
+                        "endRestoreTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to end the restore by (UTC)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The parameters of the restore operation that initiated the table.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "schemaType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The table name."
+                          }
+                        },
+                        "columns": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.columnType"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of table custom columns."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table description."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The table display name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The table schema.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "searchResultsType": {
+                      "type": "object",
+                      "properties": {
+                        "query": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The search job query."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The search description."
+                          }
+                        },
+                        "limit": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Limit the search job to return up to specified number of rows."
+                          }
+                        },
+                        "startSearchTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to start the search from (UTC)."
+                          }
+                        },
+                        "endSearchTime": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The timestamp to end the search by (UTC)."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The parameters of the search job that initiated the table.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "table/main.bicep"
+                        }
+                      }
+                    },
+                    "solutionPlanType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                          }
+                        },
+                        "product": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                          }
+                        },
+                        "publisher": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Log Analytics workspace."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "PerGB2018",
+                      "allowedValues": [
+                        "CapacityReservation",
+                        "Free",
+                        "LACluster",
+                        "PerGB2018",
+                        "PerNode",
+                        "Premium",
+                        "Standalone",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The name of the SKU."
+                      }
+                    },
+                    "skuCapacityReservationLevel": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "minValue": 100,
+                      "maxValue": 5000,
+                      "metadata": {
+                        "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
+                      }
+                    },
+                    "storageInsightsConfigs": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/storageInsightsConfigType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of storage accounts to be read by the workspace."
+                      }
+                    },
+                    "linkedServices": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/linkedServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of services to be linked."
+                      }
+                    },
+                    "linkedStorageAccounts": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/linkedStorageAccountType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
+                      }
+                    },
+                    "savedSearches": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/savedSearchType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Kusto Query Language searches to save."
+                      }
+                    },
+                    "dataExports": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataExportType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. LAW data export instances to be deployed."
+                      }
+                    },
+                    "dataSources": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataSourceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. LAW data sources to configure."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/tableType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. LAW custom tables to be deployed."
+                      }
+                    },
+                    "gallerySolutions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/gallerySolutionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
+                      }
+                    },
+                    "onboardWorkspaceToSentinel": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions."
+                      }
+                    },
+                    "dataRetention": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "minValue": 0,
+                      "maxValue": 730,
+                      "metadata": {
+                        "description": "Optional. Number of days data will be retained for."
+                      }
+                    },
+                    "dailyQuotaGb": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "minValue": -1,
+                      "metadata": {
+                        "description": "Optional. The workspace daily quota for ingestion."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Log Analytics ingestion."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Log Analytics query."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
+                      }
+                    },
+                    "features": {
+                      "$ref": "#/definitions/workspaceFeaturesType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The workspace features."
+                      }
+                    },
+                    "replication": {
+                      "$ref": "#/definitions/workspaceReplicationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The workspace replication properties."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "forceCmkForQuery": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.OperationalInsights/workspaces@2025-02-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
+                      "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "logAnalyticsWorkspace": {
+                      "type": "Microsoft.OperationalInsights/workspaces",
+                      "apiVersion": "2025-02-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": {
+                        "features": {
+                          "searchVersion": 1,
+                          "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]",
+                          "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]",
+                          "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]",
+                          "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]"
+                        },
+                        "sku": {
+                          "name": "[parameters('skuName')]",
+                          "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
+                        },
+                        "retentionInDays": "[parameters('dataRetention')]",
+                        "workspaceCapping": {
+                          "dailyQuotaGb": "[parameters('dailyQuotaGb')]"
+                        },
+                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                        "forceCmkForQuery": "[parameters('forceCmkForQuery')]",
+                        "replication": "[parameters('replication')]"
+                      },
+                      "identity": "[variables('identity')]"
+                    },
+                    "logAnalyticsWorkspace_diagnosticSettings": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_sentinelOnboarding": {
+                      "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]",
+                      "type": "Microsoft.SecurityInsights/onboardingStates",
+                      "apiVersion": "2024-03-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "default",
+                      "properties": {},
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_roleAssignments": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_storageInsightConfigs": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_storageInsightConfigs",
+                        "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "containers": {
+                            "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]"
+                          },
+                          "tables": {
+                            "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "1306323182548882150"
+                            },
+                            "name": "Log Analytics Workspace Storage Insight Configs",
+                            "description": "This module deploys a Log Analytics Workspace Storage Insight Config."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
+                              "metadata": {
+                                "description": "Optional. The name of the storage insights config."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Azure Resource Manager ID of the storage account resource."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The names of the blob containers that the workspace should read."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The names of the Azure tables that the workspace should read."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs@2025-02-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2024-01-01",
+                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
+                            },
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "storageinsightconfig": {
+                              "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "containers": "[parameters('containers')]",
+                                "tables": "[parameters('tables')]",
+                                "storageAccount": {
+                                  "id": "[parameters('storageAccountResourceId')]",
+                                  "key": "[listKeys('storageAccount', '2024-01-01').keys[0].value]"
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed storage insights configuration."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the storage insight configuration is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the storage insights configuration."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_linkedServices": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_linkedServices",
+                        "count": "[length(coalesce(parameters('linkedServices'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]"
+                          },
+                          "resourceId": {
+                            "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]"
+                          },
+                          "writeAccessResourceId": {
+                            "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "5230241501765697269"
+                            },
+                            "name": "Log Analytics Workspace Linked Services",
+                            "description": "This module deploys a Log Analytics Workspace Linked Service."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the link."
+                              }
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
+                              }
+                            },
+                            "writeAccessResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/linkedServices@2025-02-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "linkedService": {
+                              "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resourceId": "[parameters('resourceId')]",
+                                "writeAccessResourceId": "[parameters('writeAccessResourceId')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed linked service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed linked service."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the linked service is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_linkedStorageAccounts": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_linkedStorageAccounts",
+                        "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]"
+                          },
+                          "storageAccountIds": {
+                            "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "10372135754202496594"
+                            },
+                            "name": "Log Analytics Workspace Linked Storage Accounts",
+                            "description": "This module deploys a Log Analytics Workspace Linked Storage Account."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "allowedValues": [
+                                "Query",
+                                "Alerts",
+                                "CustomLogs",
+                                "AzureWatson"
+                              ],
+                              "metadata": {
+                                "description": "Required. Name of the link."
+                              }
+                            },
+                            "storageAccountIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "minLength": 1,
+                              "metadata": {
+                                "description": "Required. Linked storage accounts resources Ids."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "linkedStorageAccount": {
+                              "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "properties": {
+                                "storageAccountIds": "[parameters('storageAccountIds')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed linked storage account."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed linked storage account."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the linked storage account is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_savedSearches": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_savedSearches",
+                        "count": "[length(coalesce(parameters('savedSearches'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(deployment().name))]"
+                          },
+                          "etag": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]"
+                          },
+                          "displayName": {
+                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]"
+                          },
+                          "category": {
+                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]"
+                          },
+                          "query": {
+                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]"
+                          },
+                          "functionAlias": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]"
+                          },
+                          "functionParameters": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]"
+                          },
+                          "tags": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]"
+                          },
+                          "version": {
+                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "9015459905306126128"
+                            },
+                            "name": "Log Analytics Workspace Saved Searches",
+                            "description": "This module deploys a Log Analytics Workspace Saved Search."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the saved search."
+                              }
+                            },
+                            "displayName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Display name for the search."
+                              }
+                            },
+                            "category": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Query category."
+                              }
+                            },
+                            "query": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Kusto Query to be stored."
+                              }
+                            },
+                            "tags": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01#properties/properties/properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            },
+                            "functionAlias": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The function alias if query serves as a function."
+                              }
+                            },
+                            "functionParameters": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
+                              }
+                            },
+                            "version": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The version number of the query language."
+                              }
+                            },
+                            "etag": {
+                              "type": "string",
+                              "defaultValue": "*",
+                              "metadata": {
+                                "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "savedSearch": {
+                              "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "properties": {
+                                "etag": "[parameters('etag')]",
+                                "tags": "[coalesce(parameters('tags'), createArray())]",
+                                "displayName": "[parameters('displayName')]",
+                                "category": "[parameters('category')]",
+                                "query": "[parameters('query')]",
+                                "functionAlias": "[parameters('functionAlias')]",
+                                "functionParameters": "[parameters('functionParameters')]",
+                                "version": "[parameters('version')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed saved search."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the saved search is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed saved search."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace",
+                        "logAnalyticsWorkspace_linkedStorageAccounts"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_dataExports": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_dataExports",
+                        "count": "[length(coalesce(parameters('dataExports'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "workspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]"
+                          },
+                          "destination": {
+                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]"
+                          },
+                          "enable": {
+                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]"
+                          },
+                          "tableNames": {
+                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "8586520532175356447"
+                            },
+                            "name": "Log Analytics Workspace Data Exports",
+                            "description": "This module deploys a Log Analytics Workspace Data Export."
+                          },
+                          "definitions": {
+                            "destinationType": {
+                              "type": "object",
+                              "properties": {
+                                "resourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The destination resource ID."
+                                  }
+                                },
+                                "metaData": {
+                                  "type": "object",
+                                  "properties": {
+                                    "eventHubName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The destination metadata."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The data export destination properties."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 4,
+                              "maxLength": 63,
+                              "metadata": {
+                                "description": "Required. The data export rule name."
+                              }
+                            },
+                            "workspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "destination": {
+                              "$ref": "#/definitions/destinationType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Destination properties."
+                              }
+                            },
+                            "enable": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Active when enabled."
+                              }
+                            },
+                            "tableNames": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "minLength": 1,
+                              "metadata": {
+                                "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('workspaceName')]"
+                            },
+                            "dataExport": {
+                              "type": "Microsoft.OperationalInsights/workspaces/dataExports",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "properties": {
+                                "destination": "[parameters('destination')]",
+                                "enable": "[parameters('enable')]",
+                                "tableNames": "[parameters('tableNames')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the data export."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the data export."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the data export was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_dataSources": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_dataSources",
+                        "count": "[length(coalesce(parameters('dataSources'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]"
+                          },
+                          "kind": {
+                            "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]"
+                          },
+                          "linkedResourceId": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]"
+                          },
+                          "eventLogName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]"
+                          },
+                          "eventTypes": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]"
+                          },
+                          "objectName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]"
+                          },
+                          "instanceName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]"
+                          },
+                          "intervalSeconds": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]"
+                          },
+                          "counterName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]"
+                          },
+                          "state": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]"
+                          },
+                          "syslogName": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]"
+                          },
+                          "syslogSeverities": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]"
+                          },
+                          "performanceCounters": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]"
+                          },
+                          "tags": {
+                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "8336916453932906250"
+                            },
+                            "name": "Log Analytics Workspace Datasources",
+                            "description": "This module deploys a Log Analytics Workspace Data Source."
+                          },
+                          "parameters": {
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the data source."
+                              }
+                            },
+                            "kind": {
+                              "type": "string",
+                              "defaultValue": "AzureActivityLog",
+                              "allowedValues": [
+                                "AzureActivityLog",
+                                "WindowsEvent",
+                                "WindowsPerformanceCounter",
+                                "IISLogs",
+                                "LinuxSyslog",
+                                "LinuxSyslogCollection",
+                                "LinuxPerformanceObject",
+                                "LinuxPerformanceCollection"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The kind of the data source."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to configure in the resource."
+                              },
+                              "nullable": true
+                            },
+                            "linkedResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource ID of the resource to be linked."
+                              }
+                            },
+                            "eventLogName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
+                              }
+                            },
+                            "eventTypes": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Windows event types to configure when kind is WindowsEvent."
+                              }
+                            },
+                            "objectName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "instanceName": {
+                              "type": "string",
+                              "defaultValue": "*",
+                              "metadata": {
+                                "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "intervalSeconds": {
+                              "type": "int",
+                              "defaultValue": 60,
+                              "metadata": {
+                                "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
+                              }
+                            },
+                            "performanceCounters": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
+                              }
+                            },
+                            "counterName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
+                              }
+                            },
+                            "state": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
+                              }
+                            },
+                            "syslogName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. System log to configure when kind is LinuxSyslog."
+                              }
+                            },
+                            "syslogSeverities": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Severities to configure when kind is LinuxSyslog."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "dataSource": {
+                              "type": "Microsoft.OperationalInsights/workspaces/dataSources",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
+                              "kind": "[parameters('kind')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
+                                "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
+                                "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
+                                "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
+                                "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
+                                "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
+                                "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
+                                "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
+                                "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
+                                "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
+                                "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed data source."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the data source is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed data source."
+                              },
+                              "value": "[parameters('name')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_tables": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_tables",
+                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "workspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                          },
+                          "plan": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]"
+                          },
+                          "schema": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]"
+                          },
+                          "retentionInDays": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]"
+                          },
+                          "totalRetentionInDays": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]"
+                          },
+                          "restoredLogs": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]"
+                          },
+                          "searchResults": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.36.1.42791",
+                              "templateHash": "315390662258960765"
+                            },
+                            "name": "Log Analytics Workspace Tables",
+                            "description": "This module deploys a Log Analytics Workspace Table."
+                          },
+                          "definitions": {
+                            "restoredLogsType": {
+                              "type": "object",
+                              "properties": {
+                                "sourceTable": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table to restore data from."
+                                  }
+                                },
+                                "startRestoreTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to start the restore from (UTC)."
+                                  }
+                                },
+                                "endRestoreTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to end the restore by (UTC)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The parameters of the restore operation that initiated the table."
+                              }
+                            },
+                            "schemaType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The table name."
+                                  }
+                                },
+                                "columns": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/columnType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of table custom columns."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table description."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The table display name."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The table schema."
+                              }
+                            },
+                            "columnType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The column name."
+                                  }
+                                },
+                                "type": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "boolean",
+                                    "dateTime",
+                                    "dynamic",
+                                    "guid",
+                                    "int",
+                                    "long",
+                                    "real",
+                                    "string"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. The column type."
+                                  }
+                                },
+                                "dataTypeHint": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "armPath",
+                                    "guid",
+                                    "ip",
+                                    "uri"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The column data type logical hint."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The column description."
+                                  }
+                                },
+                                "displayName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Column display name."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The parameters of the table column."
+                              }
+                            },
+                            "searchResultsType": {
+                              "type": "object",
+                              "properties": {
+                                "query": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The search job query."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The search description."
+                                  }
+                                },
+                                "limit": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Limit the search job to return up to specified number of rows."
+                                  }
+                                },
+                                "startSearchTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to start the search from (UTC)."
+                                  }
+                                },
+                                "endSearchTime": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The timestamp to end the search by (UTC)."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The parameters of the search job that initiated the table."
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the table."
+                              }
+                            },
+                            "workspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "plan": {
+                              "type": "string",
+                              "defaultValue": "Analytics",
+                              "allowedValues": [
+                                "Basic",
+                                "Analytics"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
+                              }
+                            },
+                            "restoredLogs": {
+                              "$ref": "#/definitions/restoredLogsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Restore parameters."
+                              }
+                            },
+                            "retentionInDays": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "minValue": -1,
+                              "maxValue": 730,
+                              "metadata": {
+                                "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention."
+                              }
+                            },
+                            "schema": {
+                              "$ref": "#/definitions/schemaType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Table's schema."
+                              }
+                            },
+                            "searchResults": {
+                              "$ref": "#/definitions/searchResultsType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Parameters of the search job that initiated this table."
+                              }
+                            },
+                            "totalRetentionInDays": {
+                              "type": "int",
+                              "defaultValue": -1,
+                              "minValue": -1,
+                              "maxValue": 2555,
+                              "metadata": {
+                                "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
+                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
+                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
+                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                            }
+                          },
+                          "resources": {
+                            "workspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2025-02-01",
+                              "name": "[parameters('workspaceName')]"
+                            },
+                            "table": {
+                              "type": "Microsoft.OperationalInsights/workspaces/tables",
+                              "apiVersion": "2025-02-01",
+                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "properties": {
+                                "plan": "[parameters('plan')]",
+                                "restoredLogs": "[parameters('restoredLogs')]",
+                                "retentionInDays": "[parameters('retentionInDays')]",
+                                "schema": "[parameters('schema')]",
+                                "searchResults": "[parameters('searchResults')]",
+                                "totalRetentionInDays": "[parameters('totalRetentionInDays')]"
+                              }
+                            },
+                            "table_roleAssignments": {
+                              "copy": {
+                                "name": "table_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "table"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the table."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the table."
+                              },
+                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the table was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    },
+                    "logAnalyticsWorkspace_solutions": {
+                      "copy": {
+                        "name": "logAnalyticsWorkspace_solutions",
+                        "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]"
+                      },
+                      "condition": "[not(empty(parameters('gallerySolutions')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "logAnalyticsWorkspaceName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "plan": {
+                            "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.32.4.45862",
+                              "templateHash": "10255889523646649592"
+                            },
+                            "name": "Operations Management Solutions",
+                            "description": "This module deploys an Operations Management Solution.",
+                            "owner": "Azure/module-maintainers"
+                          },
+                          "definitions": {
+                            "solutionPlanType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
+                                  }
+                                },
+                                "product": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
+                                  }
+                                },
+                                "publisher": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
+                              }
+                            },
+                            "plan": {
+                              "$ref": "#/definitions/solutionPlanType",
+                              "metadata": {
+                                "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
+                              }
+                            },
+                            "logAnalyticsWorkspaceName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "logAnalyticsWorkspace": {
+                              "existing": true,
+                              "type": "Microsoft.OperationalInsights/workspaces",
+                              "apiVersion": "2021-06-01",
+                              "name": "[parameters('logAnalyticsWorkspaceName')]"
+                            },
+                            "solution": {
+                              "type": "Microsoft.OperationsManagement/solutions",
+                              "apiVersion": "2015-11-01-preview",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
+                              },
+                              "plan": {
+                                "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]",
+                                "promotionCode": "",
+                                "product": "[parameters('plan').product]",
+                                "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed solution."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed solution."
+                              },
+                              "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group where the solution is deployed."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('solution', '2015-11-01-preview', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "logAnalyticsWorkspace"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed log analytics workspace."
+                      },
+                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed log analytics workspace."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed log analytics workspace."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "logAnalyticsWorkspaceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The ID associated with the workspace."
+                      },
+                      "value": "[reference('logAnalyticsWorkspace').customerId]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('logAnalyticsWorkspace', '2025-02-01', 'full').location]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2025-02-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "primarySharedKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary shared key of the log analytics workspace."
+                      },
+                      "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').primarySharedKey]"
+                    },
+                    "secondarySharedKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary shared key of the log analytics workspace."
+                      },
+                      "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').secondarySharedKey]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('logAnalytics').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "value": "[reference('logAnalytics').outputs.name.value]"
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "value": "[reference('logAnalytics').outputs.logAnalyticsWorkspaceId.value]"
+            },
+            "primarySharedKey": {
+              "type": "securestring",
+              "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').primarySharedKey]"
+            },
+            "secondarySharedKey": {
+              "type": "securestring",
+              "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').secondarySharedKey]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "userAssignedIdentity"
+      ]
+    },
+    "appInsights": {
+      "condition": "[variables('shouldCreateAppInsights')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('appInsights-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "appInsightsName": {
+            "value": "[variables('appInsightsName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "logAnalyticsResourceId": "[if(not(empty(parameters('existingLogAnalyticsWorkspaceId'))), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), if(variables('shouldCreateLogAnalytics'), createObject('value', reference('logAnalytics').outputs.resourceId.value), createObject('value', '')))]",
+          "roleAssignedManagedIdentityPrincipalIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.principalId.value]"
+            ]
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "7816056445250265887"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Location for all resources"
+              }
+            },
+            "appInsightsName": {
+              "type": "string",
+              "metadata": {
+                "description": "Application Insights name"
+              }
+            },
+            "logAnalyticsResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Log Analytics resource id output from log-analytics-ws.bicep module"
+              }
+            },
+            "roleAssignedManagedIdentityPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Managed Identity that will be given access to the Application Insights"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "resources": {
+            "applicationInsights": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('applicationInsights-{0}', uniqueString('applicationInsights', deployment().name))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('appInsightsName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "workspaceResourceId": {
+                    "value": "[parameters('logAnalyticsResourceId')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "disableLocalAuth": {
+                    "value": false
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.33.93.31351",
+                      "templateHash": "5735496719243704506"
+                    },
+                    "name": "Application Insights",
+                    "description": "This component deploys an Application Insights instance."
+                  },
+                  "definitions": {
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Application Insights."
+                      }
+                    },
+                    "applicationType": {
+                      "type": "string",
+                      "defaultValue": "web",
+                      "allowedValues": [
+                        "web",
+                        "other"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Application type."
+                      }
+                    },
+                    "workspaceResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
+                      }
+                    },
+                    "disableIpMasking": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Disable IP masking. Default value is set to true."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
+                      }
+                    },
+                    "forceCustomerStorageForProfiler": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Force users to create their own storage account for profiler and debugger."
+                      }
+                    },
+                    "linkedStorageAccountResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Linked storage account resource ID."
+                      }
+                    },
+                    "publicNetworkAccessForIngestion": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
+                      }
+                    },
+                    "publicNetworkAccessForQuery": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
+                      }
+                    },
+                    "retentionInDays": {
+                      "type": "int",
+                      "defaultValue": 365,
+                      "allowedValues": [
+                        30,
+                        60,
+                        90,
+                        120,
+                        180,
+                        270,
+                        365,
+                        550,
+                        730
+                      ],
+                      "metadata": {
+                        "description": "Optional. Retention period in days."
+                      }
+                    },
+                    "samplingPercentage": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "minValue": 0,
+                      "maxValue": 100,
+                      "metadata": {
+                        "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
+                      }
+                    },
+                    "flowType": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API."
+                      }
+                    },
+                    "requestSource": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Tags of the resource."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
+                      "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
+                      "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
+                      "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
+                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "appInsights": {
+                      "type": "Microsoft.Insights/components",
+                      "apiVersion": "2020-02-02",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "properties": {
+                        "Application_Type": "[parameters('applicationType')]",
+                        "DisableIpMasking": "[parameters('disableIpMasking')]",
+                        "DisableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
+                        "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
+                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
+                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
+                        "RetentionInDays": "[parameters('retentionInDays')]",
+                        "SamplingPercentage": "[parameters('samplingPercentage')]",
+                        "Flow_Type": "[parameters('flowType')]",
+                        "Request_Source": "[parameters('requestSource')]"
+                      }
+                    },
+                    "appInsights_roleAssignments": {
+                      "copy": {
+                        "name": "appInsights_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "appInsights_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "appInsights_diagnosticSettings": {
+                      "copy": {
+                        "name": "appInsights_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    },
+                    "linkedStorageAccount": {
+                      "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appInsightsName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "storageAccountResourceId": {
+                            "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.33.93.31351",
+                              "templateHash": "10861379689695100897"
+                            },
+                            "name": "Application Insights Linked Storage Account",
+                            "description": "This component deploys an Application Insights Linked Storage Account."
+                          },
+                          "parameters": {
+                            "appInsightsName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "storageAccountResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Linked storage account resource ID."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "microsoft.insights/components/linkedStorageAccounts",
+                              "apiVersion": "2020-03-01-preview",
+                              "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
+                              "properties": {
+                                "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Linked Storage Account."
+                              },
+                              "value": "ServiceProfiler"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Linked Storage Account."
+                              },
+                              "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the agent pool was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "appInsights"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the application insights component."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the application insights component."
+                      },
+                      "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the application insights component was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "applicationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The application ID of the application insights component."
+                      },
+                      "value": "[reference('appInsights').AppId]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('appInsights', '2020-02-02', 'full').location]"
+                    },
+                    "instrumentationKey": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
+                      },
+                      "value": "[reference('appInsights').InstrumentationKey]"
+                    },
+                    "connectionString": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Application Insights Connection String."
+                      },
+                      "value": "[reference('appInsights').ConnectionString]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('applicationInsights').outputs.resourceId.value]"
+            },
+            "applicationId": {
+              "type": "string",
+              "value": "[reference('applicationInsights').outputs.applicationId.value]"
+            },
+            "instrumentationKey": {
+              "type": "string",
+              "value": "[reference('applicationInsights').outputs.instrumentationKey.value]"
+            },
+            "connectionString": {
+              "type": "string",
+              "value": "[reference('applicationInsights').outputs.connectionString.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalytics",
+        "userAssignedIdentity"
+      ]
+    },
+    "queueDnsZone": {
+      "condition": "[variables('shouldCreateQueueDnsZone')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('queue-dns-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "vnetResourceId": {
+            "value": "[parameters('existingVnetResourceId')]"
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "18409778870475030310"
+            }
+          },
+          "parameters": {
+            "vnetResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the VNet to link the DNS zone to"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2024-06-01",
+              "name": "privatelink.queue.core.windows.net",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2024-06-01",
+              "name": "[format('{0}/{1}', 'privatelink.queue.core.windows.net', format('{0}-queue-link', last(split(parameters('vnetResourceId'), '/'))))]",
+              "location": "global",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "virtualNetwork": {
+                  "id": "[parameters('vnetResourceId')]"
+                },
+                "registrationEnabled": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.queue.core.windows.net')]"
+              ]
+            }
+          ],
+          "outputs": {
+            "dnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.queue.core.windows.net')]"
+            }
+          }
+        }
+      }
+    },
+    "storage": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('storage-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "storageAccountName": {
+            "value": "[variables('storageAccountName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "docsContainerName": {
+            "value": "[parameters('docsContainerName')]"
+          },
+          "roleAssignedManagedIdentityPrincipalIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.principalId.value]"
+            ]
+          },
+          "enablePrivateEndpoint": {
+            "value": "[variables('isAILZIntegrated')]"
+          },
+          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
+          "blobPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.blob), createObject('value', ''))]",
+          "queuePrivateDnsZoneId": "[if(variables('isAILZIntegrated'), if(not(empty(parameters('existingQueuePrivateDnsZoneId'))), createObject('value', parameters('existingQueuePrivateDnsZoneId')), if(variables('shouldCreateQueueDnsZone'), createObject('value', reference('queueDnsZone').outputs.dnsZoneId.value), createObject('value', ''))), createObject('value', ''))]",
+          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "logAnalyticsWorkspaceId": "[if(not(empty(parameters('existingLogAnalyticsWorkspaceId'))), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), if(variables('shouldCreateLogAnalytics'), createObject('value', reference('logAnalytics').outputs.resourceId.value), createObject('value', '')))]",
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "1736139892580946894"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Location for all resources"
+              }
+            },
+            "storageAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Storage account name"
+              }
+            },
+            "skuName": {
+              "type": "string",
+              "defaultValue": "Standard_LRS",
+              "allowedValues": [
+                "Standard_LRS",
+                "Standard_GRS",
+                "Standard_RAGRS",
+                "Standard_ZRS",
+                "Premium_LRS",
+                "Premium_ZRS"
+              ],
+              "metadata": {
+                "description": "Storage account SKU name"
+              }
+            },
+            "docsContainerName": {
+              "type": "string",
+              "metadata": {
+                "description": "Container name for documents"
+              }
+            },
+            "roleAssignedManagedIdentityPrincipalIds": {
+              "type": "array",
+              "metadata": {
+                "description": "Managed identities that will be given access to the storage account"
+              }
+            },
+            "enablePrivateEndpoint": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable private endpoint for AILZ mode"
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "blobPrivateDnsZoneId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Blob Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "queuePrivateDnsZoneId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Queue Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Public network access setting"
+              }
+            },
+            "logAnalyticsWorkspaceId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Log Analytics Workspace ID for diagnostic settings"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "accountRoleAssignments",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('accountRoleAssignments')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "Contributor"
+                }
+              },
+              {
+                "name": "blobRoleAssignments",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('blobRoleAssignments')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "Storage Blob Data Contributor"
+                }
+              },
+              {
+                "name": "queueRoleAssignments",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('queueRoleAssignments')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "Storage Queue Data Contributor"
+                }
+              }
+            ],
+            "deployerRoleAssignments": [
+              {
+                "principalId": "[deployer().objectId]",
+                "principalType": "User",
+                "roleDefinitionIdOrName": "Storage Blob Data Contributor"
+              },
+              {
+                "principalId": "[deployer().objectId]",
+                "principalType": "User",
+                "roleDefinitionIdOrName": "Storage Queue Data Contributor"
+              }
+            ]
+          },
+          "resources": {
+            "storageAccount": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}.storageAccount', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('storageAccountName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "kind": {
+                    "value": "StorageV2"
+                  },
+                  "skuName": {
+                    "value": "[parameters('skuName')]"
+                  },
+                  "accessTier": {
+                    "value": "Hot"
+                  },
+                  "diagnosticSettings": {
+                    "value": [
+                      {
+                        "workspaceResourceId": "[parameters('logAnalyticsWorkspaceId')]"
+                      }
+                    ]
+                  },
+                  "allowSharedKeyAccess": {
+                    "value": false
+                  },
+                  "enableHierarchicalNamespace": {
+                    "value": false
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "networkAcls": "[if(parameters('enablePrivateEndpoint'), createObject('value', createObject('defaultAction', 'Deny', 'bypass', 'AzureServices', 'ipRules', createArray(), 'virtualNetworkRules', createArray())), createObject('value', createObject('defaultAction', 'Allow', 'bypass', 'AzureServices')))]",
+                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-blob-pe', parameters('storageAccountName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'blob', 'privateLinkServiceConnectionName', format('{0}-blob-plsc', parameters('storageAccountName')), 'privateDnsZoneGroup', if(not(empty(parameters('blobPrivateDnsZoneId'))), createObject('name', 'blob-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'blob-config', 'privateDnsZoneResourceId', parameters('blobPrivateDnsZoneId')))), null())), createObject('name', format('{0}-queue-pe', parameters('storageAccountName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'queue', 'privateLinkServiceConnectionName', format('{0}-queue-plsc', parameters('storageAccountName')), 'privateDnsZoneGroup', if(not(empty(parameters('queuePrivateDnsZoneId'))), createObject('name', 'queue-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'queue-config', 'privateDnsZoneResourceId', parameters('queuePrivateDnsZoneId')))), null())))), createObject('value', createArray()))]",
+                  "blobServices": {
+                    "value": {
+                      "automaticSnapshotPolicyEnabled": true,
+                      "deleteRetentionPolicyDays": 7,
+                      "deleteRetentionPolicyEnabled": true,
+                      "containerDeleteRetentionPolicyDays": 7,
+                      "containerDeleteRetentionPolicyEnabled": true,
+                      "containers": [
+                        {
+                          "name": "[parameters('docsContainerName')]",
+                          "publicAccess": "None"
+                        }
+                      ]
+                    }
+                  },
+                  "queueServices": {
+                    "value": {
+                      "queues": [
+                        {
+                          "name": "contentflow-execution-requests",
+                          "metadata": {}
+                        }
+                      ]
+                    }
+                  },
+                  "roleAssignments": {
+                    "value": "[concat(variables('accountRoleAssignments'), variables('blobRoleAssignments'), variables('queueRoleAssignments'), variables('deployerRoleAssignments'))]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.37.4.10188",
+                      "templateHash": "3530476863855541150"
+                    },
+                    "name": "Storage Accounts",
+                    "description": "This module deploys a Storage Account."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the private endpoints output."
+                      }
+                    },
+                    "networkAclsType": {
+                      "type": "object",
+                      "properties": {
+                        "resourceAccessRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "tenantId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The ID of the tenant in which the resource resides in."
+                                }
+                              },
+                              "resourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
+                          }
+                        },
+                        "bypass": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureServices",
+                            "AzureServices, Logging",
+                            "AzureServices, Logging, Metrics",
+                            "AzureServices, Metrics",
+                            "Logging",
+                            "Logging, Metrics",
+                            "Metrics",
+                            "None"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
+                          }
+                        },
+                        "virtualNetworkRules": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Sets the virtual network rules."
+                          }
+                        },
+                        "ipRules": {
+                          "type": "array",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Sets the IP ACL rules."
+                          }
+                        },
+                        "defaultAction": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Allow",
+                            "Deny"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the default action of allow or deny when no other rules match."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the network configuration."
+                      }
+                    },
+                    "secretsExportConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                          }
+                        },
+                        "accessKey1Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The accessKey1 secret name to create."
+                          }
+                        },
+                        "connectionString1Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The connectionString1 secret name to create."
+                          }
+                        },
+                        "accessKey2Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The accessKey2 secret name to create."
+                          }
+                        },
+                        "connectionString2Name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The connectionString2 secret name to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of the exported secrets."
+                      }
+                    },
+                    "localUserType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the local user used for SFTP Authentication."
+                          }
+                        },
+                        "hasSharedKey": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                          }
+                        },
+                        "hasSshKey": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                          }
+                        },
+                        "hasSshPassword": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                          }
+                        },
+                        "homeDirectory": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The local user home directory."
+                          }
+                        },
+                        "permissionScopes": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/permissionScopeType"
+                          },
+                          "metadata": {
+                            "description": "Required. The permission scopes of the local user."
+                          }
+                        },
+                        "sshAuthorizedKeys": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/sshAuthorizedKeyType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The local user SSH authorized keys for SFTP."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a local user."
+                      }
+                    },
+                    "blobServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "automaticSnapshotPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Automatic Snapshot is enabled if set to true."
+                          }
+                        },
+                        "changeFeedEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                          }
+                        },
+                        "changeFeedRetentionInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 146000,
+                          "metadata": {
+                            "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                          }
+                        },
+                        "containerDeleteRetentionPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                          }
+                        },
+                        "containerDeleteRetentionPolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 365,
+                          "metadata": {
+                            "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                          }
+                        },
+                        "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                          }
+                        },
+                        "corsRules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/corsRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                          }
+                        },
+                        "defaultServiceVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                          }
+                        },
+                        "deleteRetentionPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for blob soft delete."
+                          }
+                        },
+                        "deleteRetentionPolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 365,
+                          "metadata": {
+                            "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                          }
+                        },
+                        "deleteRetentionPolicyAllowPermanentDelete": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                          }
+                        },
+                        "isVersioningEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                          }
+                        },
+                        "lastAccessTimeTrackingPolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                          }
+                        },
+                        "restorePolicyEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                          }
+                        },
+                        "restorePolicyDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "metadata": {
+                            "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                          }
+                        },
+                        "containers": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Blob containers to create."
+                          }
+                        },
+                        "diagnosticSettings": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/diagnosticSettingFullType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The diagnostic settings of the service."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of a blob service."
+                      }
+                    },
+                    "_1.immutabilityPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "immutabilityPeriodSinceCreationInDays": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                          }
+                        },
+                        "allowProtectedAppendWrites": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                          }
+                        },
+                        "allowProtectedAppendWritesAll": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for an immutability policy.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "blob-service/container/main.bicep"
+                        }
+                      }
+                    },
+                    "_2.secretSetOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "secretResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resourceId of the exported secret."
+                          }
+                        },
+                        "secretUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI of the exported secret."
+                          }
+                        },
+                        "secretUriWithVersion": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The secret URI with version of the exported secret."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "_3.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_3.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_3.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_3.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_3.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "containerType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the Storage Container to deploy."
+                          }
+                        },
+                        "defaultEncryptionScope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Default the container to use specified encryption scope for all writes."
+                          }
+                        },
+                        "denyEncryptionScopeOverride": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Block override of encryption scope from the container default."
+                          }
+                        },
+                        "enableNfsV3AllSquash": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable NFSv3 all squash on blob container."
+                          }
+                        },
+                        "enableNfsV3RootSquash": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable NFSv3 root squash on blob container."
+                          }
+                        },
+                        "immutableStorageWithVersioningEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                          }
+                        },
+                        "immutabilityPolicy": {
+                          "$ref": "#/definitions/_1.immutabilityPolicyType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Configure immutability policy."
+                          }
+                        },
+                        "metadata": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                            },
+                            "description": "Optional. A name-value pair to associate with the container as metadata."
+                          },
+                          "nullable": true
+                        },
+                        "publicAccess": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Blob",
+                            "Container",
+                            "None"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type of a storage container.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "blob-service/main.bicep"
+                        }
+                      }
+                    },
+                    "corsRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "allowedValues": [
+                            "CONNECT",
+                            "DELETE",
+                            "GET",
+                            "HEAD",
+                            "MERGE",
+                            "OPTIONS",
+                            "PATCH",
+                            "POST",
+                            "PUT",
+                            "TRACE"
+                          ],
+                          "metadata": {
+                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                          }
+                        },
+                        "exposedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of response headers to expose to CORS clients."
+                          }
+                        },
+                        "maxAgeInSeconds": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a cors rule.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "blob-service/main.bicep"
+                        }
+                      }
+                    },
+                    "customerManagedKeyWithAutoRotateType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                          }
+                        },
+                        "autoRotationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingMetricsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "permissionScopeType": {
+                      "type": "object",
+                      "properties": {
+                        "permissions": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                          }
+                        },
+                        "resourceName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service used by the local user, e.g. blob, file."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "local-user/main.bicep"
+                        }
+                      }
+                    },
+                    "privateEndpointMultiServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the private endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_3.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_3.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "secretsOutputType": {
+                      "type": "object",
+                      "properties": {},
+                      "additionalProperties": {
+                        "$ref": "#/definitions/_2.secretSetOutputType",
+                        "metadata": {
+                          "description": "An exported secret's references."
+                        }
+                      },
+                      "metadata": {
+                        "description": "A map of the exported secrets",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "sshAuthorizedKeyType": {
+                      "type": "object",
+                      "properties": {
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Description used to store the function/usage of the key."
+                          }
+                        },
+                        "key": {
+                          "type": "securestring",
+                          "metadata": {
+                            "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "local-user/main.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "maxLength": 24,
+                      "metadata": {
+                        "description": "Required. Name of the Storage Account. Must be lower-case."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "StorageV2",
+                      "allowedValues": [
+                        "Storage",
+                        "StorageV2",
+                        "BlobStorage",
+                        "FileStorage",
+                        "BlockBlobStorage"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Type of Storage Account to create."
+                      }
+                    },
+                    "skuName": {
+                      "type": "string",
+                      "defaultValue": "Standard_GRS",
+                      "allowedValues": [
+                        "Standard_LRS",
+                        "Standard_ZRS",
+                        "Standard_GRS",
+                        "Standard_GZRS",
+                        "Standard_RAGRS",
+                        "Standard_RAGZRS",
+                        "StandardV2_LRS",
+                        "StandardV2_ZRS",
+                        "StandardV2_GRS",
+                        "StandardV2_GZRS",
+                        "Premium_LRS",
+                        "Premium_ZRS",
+                        "PremiumV2_LRS",
+                        "PremiumV2_ZRS"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage."
+                      }
+                    },
+                    "accessTier": {
+                      "type": "string",
+                      "defaultValue": "Hot",
+                      "allowedValues": [
+                        "Premium",
+                        "Hot",
+                        "Cool",
+                        "Cold"
+                      ],
+                      "metadata": {
+                        "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
+                      }
+                    },
+                    "largeFileSharesState": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
+                      }
+                    },
+                    "azureFilesIdentityBasedAuthentication": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication"
+                        },
+                        "description": "Optional. Provides the identity based authentication settings for Azure Files."
+                      },
+                      "nullable": true
+                    },
+                    "defaultToOAuthAuthentication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
+                      }
+                    },
+                    "allowSharedKeyAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointMultiServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    },
+                    "managementPolicyRules": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The Storage Account ManagementPolicies Rules."
+                      }
+                    },
+                    "networkAcls": {
+                      "$ref": "#/definitions/networkAclsType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
+                      }
+                    },
+                    "requireInfrastructureEncryption": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
+                      }
+                    },
+                    "allowCrossTenantReplication": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Allow or disallow cross AAD tenant object replication."
+                      }
+                    },
+                    "customDomainName": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
+                      }
+                    },
+                    "customDomainUseSubDomainName": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
+                      }
+                    },
+                    "dnsEndpointType": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "AzureDnsZone",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
+                      }
+                    },
+                    "blobServices": {
+                      "$ref": "#/definitions/blobServiceType",
+                      "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
+                      "metadata": {
+                        "description": "Optional. Blob service and containers to deploy."
+                      }
+                    },
+                    "fileServices": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. File service and shares to deploy."
+                      }
+                    },
+                    "queueServices": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Queue service and queues to create."
+                      }
+                    },
+                    "tableServices": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Table service and tables to create."
+                      }
+                    },
+                    "allowBlobPublicAccess": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
+                      }
+                    },
+                    "minimumTlsVersion": {
+                      "type": "string",
+                      "defaultValue": "TLS1_2",
+                      "allowedValues": [
+                        "TLS1_2"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore."
+                      }
+                    },
+                    "enableHierarchicalNamespace": {
+                      "type": "bool",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
+                      }
+                    },
+                    "enableSftp": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
+                      }
+                    },
+                    "localUsers": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/localUserType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Local users to deploy for SFTP authentication."
+                      }
+                    },
+                    "isLocalUserEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables local users feature, if set to true."
+                      }
+                    },
+                    "enableNfsV3": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "allowedCopyScope": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "AAD",
+                        "PrivateLink"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                      }
+                    },
+                    "supportsHttpsTrafficOnly": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition."
+                      }
+                    },
+                    "sasExpirationPeriod": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
+                      }
+                    },
+                    "sasExpirationAction": {
+                      "type": "string",
+                      "defaultValue": "Log",
+                      "allowedValues": [
+                        "Block",
+                        "Log"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The SAS expiration action. Allowed values are Block and Log."
+                      }
+                    },
+                    "keyType": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Account",
+                        "Service"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The keyType to use with Queue & Table services."
+                      }
+                    },
+                    "secretsExportConfiguration": {
+                      "$ref": "#/definitions/secretsExportConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                      }
+                    },
+                    "immutableStorageWithVersioning": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning"
+                        },
+                        "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts."
+                      },
+                      "nullable": true
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]",
+                    "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                    "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                      "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
+                      "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
+                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "cMKUserAssignedIdentity": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                    },
+                    "storageAccount": {
+                      "type": "Microsoft.Storage/storageAccounts",
+                      "apiVersion": "2024-01-01",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "kind": "[parameters('kind')]",
+                      "sku": {
+                        "name": "[parameters('skuName')]"
+                      },
+                      "identity": "[variables('identity')]",
+                      "tags": "[parameters('tags')]",
+                      "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]",
+                      "dependsOn": [
+                        "cMKKeyVault",
+                        "cMKKeyVault::cMKKey"
+                      ]
+                    },
+                    "storageAccount_diagnosticSettings": {
+                      "copy": {
+                        "name": "storageAccount_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_roleAssignments": {
+                      "copy": {
+                        "name": "storageAccount_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_privateEndpoints": {
+                      "copy": {
+                        "name": "storageAccount_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "12389807800450456797"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateLinkServiceConnectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the private link service connection."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                      }
+                                    },
+                                    "privateLinkServiceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource id of private link service."
+                                      }
+                                    },
+                                    "requestMessage": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private link service connection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "customDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipConfigurationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              }
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              }
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom DNS configurations."
+                              }
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.34.44.8038",
+                                      "templateHash": "13997305779829540948"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "privateDnsZoneConfigsVar",
+                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                        "input": {
+                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                          "properties": {
+                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "metadata": {
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_managementPolicies": {
+                      "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "rules": {
+                            "value": "[parameters('managementPolicyRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "14529265638306912023"
+                            },
+                            "name": "Storage Account Management Policies",
+                            "description": "This module deploys a Storage Account Management Policy."
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "rules": {
+                              "type": "array",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules"
+                                },
+                                "description": "Required. The Storage Account ManagementPolicies Rules."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.Storage/storageAccounts/managementPolicies",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                              "properties": {
+                                "policy": {
+                                  "rules": "[parameters('rules')]"
+                                }
+                              }
+                            }
+                          ],
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed management policy."
+                              },
+                              "value": "default"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed management policy."
+                              },
+                              "value": "default"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed management policy."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount",
+                        "storageAccount_blobServices"
+                      ]
+                    },
+                    "storageAccount_localUsers": {
+                      "copy": {
+                        "name": "storageAccount_localUsers",
+                        "count": "[length(coalesce(parameters('localUsers'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]"
+                          },
+                          "hasSshKey": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]"
+                          },
+                          "hasSshPassword": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]"
+                          },
+                          "permissionScopes": {
+                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]"
+                          },
+                          "hasSharedKey": {
+                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]"
+                          },
+                          "homeDirectory": {
+                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]"
+                          },
+                          "sshAuthorizedKeys": {
+                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "3261275799710495788"
+                            },
+                            "name": "Storage Account Local Users",
+                            "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication."
+                          },
+                          "definitions": {
+                            "sshAuthorizedKeyType": {
+                              "type": "object",
+                              "properties": {
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Description used to store the function/usage of the key."
+                                  }
+                                },
+                                "key": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "permissionScopeType": {
+                              "type": "object",
+                              "properties": {
+                                "permissions": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                                  }
+                                },
+                                "resourceName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                                  }
+                                },
+                                "service": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The service used by the local user, e.g. blob, file."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the local user used for SFTP Authentication."
+                              }
+                            },
+                            "hasSharedKey": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                              }
+                            },
+                            "hasSshKey": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                              }
+                            },
+                            "hasSshPassword": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                              }
+                            },
+                            "homeDirectory": {
+                              "type": "string",
+                              "defaultValue": "",
+                              "metadata": {
+                                "description": "Optional. The local user home directory."
+                              }
+                            },
+                            "permissionScopes": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/permissionScopeType"
+                              },
+                              "metadata": {
+                                "description": "Required. The permission scopes of the local user."
+                              }
+                            },
+                            "sshAuthorizedKeys": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sshAuthorizedKeyType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The local user SSH authorized keys for SFTP."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2024-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "localUsers": {
+                              "type": "Microsoft.Storage/storageAccounts/localUsers",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                              "properties": {
+                                "hasSharedKey": "[parameters('hasSharedKey')]",
+                                "hasSshKey": "[parameters('hasSshKey')]",
+                                "hasSshPassword": "[parameters('hasSshPassword')]",
+                                "homeDirectory": "[parameters('homeDirectory')]",
+                                "permissionScopes": "[parameters('permissionScopes')]",
+                                "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed local user."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed local user."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed local user."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_blobServices": {
+                      "condition": "[not(empty(parameters('blobServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "containers": {
+                            "value": "[tryGet(parameters('blobServices'), 'containers')]"
+                          },
+                          "automaticSnapshotPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
+                          },
+                          "changeFeedEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
+                          },
+                          "changeFeedRetentionInDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
+                          },
+                          "containerDeleteRetentionPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
+                          },
+                          "containerDeleteRetentionPolicyDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
+                          },
+                          "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
+                          },
+                          "defaultServiceVersion": {
+                            "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
+                          },
+                          "deleteRetentionPolicyAllowPermanentDelete": {
+                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
+                          },
+                          "deleteRetentionPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
+                          },
+                          "deleteRetentionPolicyDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
+                          },
+                          "isVersioningEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
+                          },
+                          "lastAccessTimeTrackingPolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
+                          },
+                          "restorePolicyEnabled": {
+                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
+                          },
+                          "restorePolicyDays": {
+                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "9925173705553594819"
+                            },
+                            "name": "Storage Account blob Services",
+                            "description": "This module deploys a Storage Account Blob Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "containerType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the Storage Container to deploy."
+                                  }
+                                },
+                                "defaultEncryptionScope": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                  }
+                                },
+                                "denyEncryptionScopeOverride": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Block override of encryption scope from the container default."
+                                  }
+                                },
+                                "enableNfsV3AllSquash": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable NFSv3 all squash on blob container."
+                                  }
+                                },
+                                "enableNfsV3RootSquash": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enable NFSv3 root squash on blob container."
+                                  }
+                                },
+                                "immutableStorageWithVersioningEnabled": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                  }
+                                },
+                                "immutabilityPolicy": {
+                                  "$ref": "#/definitions/immutabilityPolicyType",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Configure immutability policy."
+                                  }
+                                },
+                                "metadata": {
+                                  "type": "object",
+                                  "metadata": {
+                                    "__bicep_resource_derived_type!": {
+                                      "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                    },
+                                    "description": "Optional. A name-value pair to associate with the container as metadata."
+                                  },
+                                  "nullable": true
+                                },
+                                "publicAccess": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Blob",
+                                    "Container",
+                                    "None"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                  }
+                                },
+                                "roleAssignments": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/roleAssignmentType"
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Array of role assignments to create."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type of a storage container."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            },
+                            "immutabilityPolicyType": {
+                              "type": "object",
+                              "properties": {
+                                "immutabilityPeriodSinceCreationInDays": {
+                                  "type": "int",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                  }
+                                },
+                                "allowProtectedAppendWrites": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                                  }
+                                },
+                                "allowProtectedAppendWritesAll": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for an immutability policy.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "container/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "automaticSnapshotPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Automatic Snapshot is enabled if set to true."
+                              }
+                            },
+                            "changeFeedEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                              }
+                            },
+                            "changeFeedRetentionInDays": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 1,
+                              "maxValue": 146000,
+                              "metadata": {
+                                "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                              }
+                            },
+                            "containerDeleteRetentionPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                              }
+                            },
+                            "containerDeleteRetentionPolicyDays": {
+                              "type": "int",
+                              "nullable": true,
+                              "minValue": 1,
+                              "maxValue": 365,
+                              "metadata": {
+                                "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                              }
+                            },
+                            "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "defaultServiceVersion": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                              }
+                            },
+                            "deleteRetentionPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for blob soft delete."
+                              }
+                            },
+                            "deleteRetentionPolicyDays": {
+                              "type": "int",
+                              "defaultValue": 7,
+                              "minValue": 1,
+                              "maxValue": 365,
+                              "metadata": {
+                                "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                              }
+                            },
+                            "deleteRetentionPolicyAllowPermanentDelete": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                              }
+                            },
+                            "isVersioningEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                              }
+                            },
+                            "lastAccessTimeTrackingPolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                              }
+                            },
+                            "restorePolicyEnabled": {
+                              "type": "bool",
+                              "defaultValue": false,
+                              "metadata": {
+                                "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                              }
+                            },
+                            "restorePolicyDays": {
+                              "type": "int",
+                              "defaultValue": 7,
+                              "minValue": 1,
+                              "metadata": {
+                                "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/containerType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Blob containers to create."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "enableReferencedModulesTelemetry": false,
+                            "name": "default"
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "blobServices": {
+                              "type": "Microsoft.Storage/storageAccounts/blobServices",
+                              "apiVersion": "2025-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "properties": {
+                                "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
+                                "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
+                                "containerDeleteRetentionPolicy": {
+                                  "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
+                                  "days": "[parameters('containerDeleteRetentionPolicyDays')]",
+                                  "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
+                                },
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                "defaultServiceVersion": "[parameters('defaultServiceVersion')]",
+                                "deleteRetentionPolicy": {
+                                  "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
+                                  "days": "[parameters('deleteRetentionPolicyDays')]",
+                                  "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
+                                },
+                                "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
+                                "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
+                                "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
+                              },
+                              "dependsOn": [
+                                "storageAccount"
+                              ]
+                            },
+                            "blobServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "blobServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "blobServices"
+                              ]
+                            },
+                            "blobServices_container": {
+                              "copy": {
+                                "name": "blobServices_container",
+                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "blobServiceName": {
+                                    "value": "[variables('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                  },
+                                  "defaultEncryptionScope": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
+                                  },
+                                  "denyEncryptionScopeOverride": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
+                                  },
+                                  "enableNfsV3AllSquash": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
+                                  },
+                                  "enableNfsV3RootSquash": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
+                                  },
+                                  "immutableStorageWithVersioningEnabled": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "publicAccess": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "immutabilityPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "5026123498979497429"
+                                    },
+                                    "name": "Storage Account Blob Containers",
+                                    "description": "This module deploys a Storage Account Blob Container."
+                                  },
+                                  "definitions": {
+                                    "immutabilityPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "immutabilityPeriodSinceCreationInDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                          }
+                                        },
+                                        "allowProtectedAppendWrites": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                                          }
+                                        },
+                                        "allowProtectedAppendWritesAll": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for an immutability policy."
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "blobServiceName": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Storage Container to deploy."
+                                      }
+                                    },
+                                    "defaultEncryptionScope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                      }
+                                    },
+                                    "denyEncryptionScopeOverride": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Block override of encryption scope from the container default."
+                                      }
+                                    },
+                                    "enableNfsV3AllSquash": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Enable NFSv3 all squash on blob container."
+                                      }
+                                    },
+                                    "enableNfsV3RootSquash": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Enable NFSv3 root squash on blob container."
+                                      }
+                                    },
+                                    "immutableStorageWithVersioningEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                      }
+                                    },
+                                    "immutabilityPolicy": {
+                                      "$ref": "#/definitions/immutabilityPolicyType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configure immutability policy."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. A name-value pair to associate with the container as metadata."
+                                      },
+                                      "defaultValue": {}
+                                    },
+                                    "publicAccess": {
+                                      "type": "string",
+                                      "defaultValue": "None",
+                                      "allowedValues": [
+                                        "Container",
+                                        "Blob",
+                                        "None"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::blobServices": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/blobServices",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "container": {
+                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+                                      "apiVersion": "2025-01-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                      "properties": {
+                                        "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]",
+                                        "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]",
+                                        "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
+                                        "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
+                                        "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
+                                        "metadata": "[parameters('metadata')]",
+                                        "publicAccess": "[parameters('publicAccess')]"
+                                      }
+                                    },
+                                    "container_roleAssignments": {
+                                      "copy": {
+                                        "name": "container_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "container"
+                                      ]
+                                    },
+                                    "container_immutabilityPolicy": {
+                                      "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('storageAccountName')]"
+                                          },
+                                          "containerName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "immutabilityPeriodSinceCreationInDays": {
+                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]"
+                                          },
+                                          "allowProtectedAppendWrites": {
+                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]"
+                                          },
+                                          "allowProtectedAppendWritesAll": {
+                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "10782942397325758470"
+                                            },
+                                            "name": "Storage Account Blob Container Immutability Policies",
+                                            "description": "This module deploys a Storage Account Blob Container Immutability Policy."
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "containerName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "immutabilityPeriodSinceCreationInDays": {
+                                              "type": "int",
+                                              "defaultValue": 365,
+                                              "metadata": {
+                                                "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                              }
+                                            },
+                                            "allowProtectedAppendWrites": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                              }
+                                            },
+                                            "allowProtectedAppendWritesAll": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "name": "default"
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]",
+                                              "properties": {
+                                                "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
+                                                "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
+                                                "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed immutability policy."
+                                              },
+                                              "value": "[variables('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed immutability policy."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed immutability policy."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "container"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed container."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed container."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed container."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "blobServices"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed blob service."
+                              },
+                              "value": "[variables('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed blob service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed blob service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_fileServices": {
+                      "condition": "[not(empty(parameters('fileServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
+                          },
+                          "protocolSettings": {
+                            "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
+                          },
+                          "shareDeleteRetentionPolicy": {
+                            "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
+                          },
+                          "shares": {
+                            "value": "[tryGet(parameters('fileServices'), 'shares')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "2735186993322606805"
+                            },
+                            "name": "Storage Account File Share Services",
+                            "description": "This module deploys a Storage Account File Share Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "default",
+                              "metadata": {
+                                "description": "Optional. The name of the file service."
+                              }
+                            },
+                            "protocolSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
+                                },
+                                "description": "Optional. Protocol settings for file service."
+                              },
+                              "defaultValue": {}
+                            },
+                            "shareDeleteRetentionPolicy": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
+                                },
+                                "description": "Optional. The service properties for soft delete."
+                              },
+                              "defaultValue": {
+                                "enabled": true,
+                                "days": 7
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            },
+                            "shares": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. File shares to create."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2024-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "fileServices": {
+                              "type": "Microsoft.Storage/storageAccounts/fileServices",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                              "properties": {
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                "protocolSettings": "[parameters('protocolSettings')]",
+                                "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
+                              }
+                            },
+                            "fileServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "fileServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "fileServices"
+                              ]
+                            },
+                            "fileServices_shares": {
+                              "copy": {
+                                "name": "fileServices_shares",
+                                "count": "[length(coalesce(parameters('shares'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "fileServicesName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
+                                  },
+                                  "accessTier": {
+                                    "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]"
+                                  },
+                                  "enabledProtocols": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
+                                  },
+                                  "rootSquash": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
+                                  },
+                                  "shareQuota": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "15881640847294537074"
+                                    },
+                                    "name": "Storage Account File Shares",
+                                    "description": "This module deploys a Storage Account File Share."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "fileServicesName": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the file share to create."
+                                      }
+                                    },
+                                    "accessTier": {
+                                      "type": "string",
+                                      "defaultValue": "TransactionOptimized",
+                                      "allowedValues": [
+                                        "Premium",
+                                        "Hot",
+                                        "Cool",
+                                        "TransactionOptimized"
+                                      ],
+                                      "metadata": {
+                                        "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                                      }
+                                    },
+                                    "shareQuota": {
+                                      "type": "int",
+                                      "defaultValue": 5120,
+                                      "metadata": {
+                                        "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                      }
+                                    },
+                                    "enabledProtocols": {
+                                      "type": "string",
+                                      "defaultValue": "SMB",
+                                      "allowedValues": [
+                                        "NFS",
+                                        "SMB"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                      }
+                                    },
+                                    "rootSquash": {
+                                      "type": "string",
+                                      "defaultValue": "NoRootSquash",
+                                      "allowedValues": [
+                                        "AllSquash",
+                                        "NoRootSquash",
+                                        "RootSquash"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::fileService": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/fileServices",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "fileShare": {
+                                      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
+                                      "properties": {
+                                        "accessTier": "[parameters('accessTier')]",
+                                        "shareQuota": "[parameters('shareQuota')]",
+                                        "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
+                                        "enabledProtocols": "[parameters('enabledProtocols')]"
+                                      }
+                                    },
+                                    "fileShare_roleAssignments": {
+                                      "copy": {
+                                        "name": "fileShare_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "scope": {
+                                            "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]"
+                                          },
+                                          "roleDefinitionId": {
+                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                          },
+                                          "principalId": {
+                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                          },
+                                          "principalType": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                                          },
+                                          "condition": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]"
+                                          },
+                                          "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]",
+                                          "delegatedManagedIdentityResourceId": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                          },
+                                          "description": {
+                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "parameters": {
+                                            "scope": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The scope to deploy the role assignment to."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the role assignment."
+                                              }
+                                            },
+                                            "roleDefinitionId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The role definition Id to assign."
+                                              }
+                                            },
+                                            "principalId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                              }
+                                            },
+                                            "principalType": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "Device",
+                                                "ForeignGroup",
+                                                "Group",
+                                                "ServicePrincipal",
+                                                "User",
+                                                ""
+                                              ],
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The principal type of the assigned principal ID."
+                                              }
+                                            },
+                                            "description": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The description of the role assignment."
+                                              }
+                                            },
+                                            "condition": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
+                                              }
+                                            },
+                                            "conditionVersion": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "2.0"
+                                              ],
+                                              "defaultValue": "2.0",
+                                              "metadata": {
+                                                "description": "Optional. Version of the condition."
+                                              }
+                                            },
+                                            "delegatedManagedIdentityResourceId": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[parameters('scope')]",
+                                              "name": "[parameters('name')]",
+                                              "properties": {
+                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                "principalId": "[parameters('principalId')]",
+                                                "description": "[parameters('description')]",
+                                                "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
+                                                "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
+                                                "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
+                                              }
+                                            }
+                                          ]
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "fileShare"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed file share."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed file share."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed file share."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "fileServices",
+                                "storageAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed file share service."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed file share service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed file share service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_queueServices": {
+                      "condition": "[not(empty(parameters('queueServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
+                          },
+                          "queues": {
+                            "value": "[tryGet(parameters('queueServices'), 'queues')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "1100093319443502715"
+                            },
+                            "name": "Storage Account Queue Services",
+                            "description": "This module deploys a Storage Account Queue Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "queues": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Queues to create."
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "name": "default"
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2024-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "queueServices": {
+                              "type": "Microsoft.Storage/storageAccounts/queueServices",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "properties": {
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                              }
+                            },
+                            "queueServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "queueServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "queueServices"
+                              ]
+                            },
+                            "queueServices_queues": {
+                              "copy": {
+                                "name": "queueServices_queues",
+                                "count": "[length(coalesce(parameters('queues'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
+                                  },
+                                  "metadata": {
+                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "17963799770990303971"
+                                    },
+                                    "name": "Storage Account Queues",
+                                    "description": "This module deploys a Storage Account Queue."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the storage queue to deploy."
+                                      }
+                                    },
+                                    "metadata": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                        },
+                                        "description": "Optional. A name-value pair that represents queue metadata."
+                                      },
+                                      "defaultValue": {}
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::queueServices": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/queueServices",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "queue": {
+                                      "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                      "properties": {
+                                        "metadata": "[parameters('metadata')]"
+                                      }
+                                    },
+                                    "queue_roleAssignments": {
+                                      "copy": {
+                                        "name": "queue_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "queue"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed queue."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed queue."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed queue."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed file share service."
+                              },
+                              "value": "[variables('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed file share service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed file share service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "storageAccount_tableServices": {
+                      "condition": "[not(empty(parameters('tableServices')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "storageAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "diagnosticSettings": {
+                            "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
+                          },
+                          "tables": {
+                            "value": "[tryGet(parameters('tableServices'), 'tables')]"
+                          },
+                          "corsRules": {
+                            "value": "[tryGet(parameters('tableServices'), 'corsRules')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "13069389074590786512"
+                            },
+                            "name": "Storage Account Table Services",
+                            "description": "This module deploys a Storage Account Table Service."
+                          },
+                          "definitions": {
+                            "corsRuleType": {
+                              "type": "object",
+                              "properties": {
+                                "allowedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                  }
+                                },
+                                "allowedMethods": {
+                                  "type": "array",
+                                  "allowedValues": [
+                                    "CONNECT",
+                                    "DELETE",
+                                    "GET",
+                                    "HEAD",
+                                    "MERGE",
+                                    "OPTIONS",
+                                    "PATCH",
+                                    "POST",
+                                    "PUT",
+                                    "TRACE"
+                                  ],
+                                  "metadata": {
+                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                  }
+                                },
+                                "allowedOrigins": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                  }
+                                },
+                                "exposedHeaders": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                  }
+                                },
+                                "maxAgeInSeconds": {
+                                  "type": "int",
+                                  "metadata": {
+                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for a cors rule."
+                              }
+                            },
+                            "diagnosticSettingFullType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the diagnostic setting."
+                                  }
+                                },
+                                "logCategoriesAndGroups": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                        }
+                                      },
+                                      "categoryGroup": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                  }
+                                },
+                                "metricCategories": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "object",
+                                    "properties": {
+                                      "category": {
+                                        "type": "string",
+                                        "metadata": {
+                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                        }
+                                      },
+                                      "enabled": {
+                                        "type": "bool",
+                                        "nullable": true,
+                                        "metadata": {
+                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                  }
+                                },
+                                "logAnalyticsDestinationType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "AzureDiagnostics",
+                                    "Dedicated"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                  }
+                                },
+                                "workspaceResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "storageAccountResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "eventHubAuthorizationRuleResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                  }
+                                },
+                                "eventHubName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                  }
+                                },
+                                "marketplacePartnerResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "storageAccountName": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "tables": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. tables to create."
+                              }
+                            },
+                            "corsRules": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/corsRuleType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                              }
+                            },
+                            "diagnosticSettings": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/diagnosticSettingFullType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The diagnostic settings of the service."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "name": "default"
+                          },
+                          "resources": {
+                            "storageAccount": {
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2024-01-01",
+                              "name": "[parameters('storageAccountName')]"
+                            },
+                            "tableServices": {
+                              "type": "Microsoft.Storage/storageAccounts/tableServices",
+                              "apiVersion": "2024-01-01",
+                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "properties": {
+                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                              }
+                            },
+                            "tableServices_diagnosticSettings": {
+                              "copy": {
+                                "name": "tableServices_diagnosticSettings",
+                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                              },
+                              "type": "Microsoft.Insights/diagnosticSettings",
+                              "apiVersion": "2021-05-01-preview",
+                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "metrics",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                    "input": {
+                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                      "timeGrain": null
+                                    }
+                                  },
+                                  {
+                                    "name": "logs",
+                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                    "input": {
+                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                    }
+                                  }
+                                ],
+                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                              },
+                              "dependsOn": [
+                                "tableServices"
+                              ]
+                            },
+                            "tableServices_tables": {
+                              "copy": {
+                                "name": "tableServices_tables",
+                                "count": "[length(parameters('tables'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('tables')[copyIndex()].name]"
+                                  },
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountName')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "10905926757212375091"
+                                    },
+                                    "name": "Storage Account Table",
+                                    "description": "This module deploys a Storage Account Table."
+                                  },
+                                  "definitions": {
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the table."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "storageAccount::tableServices": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts/tableServices",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                    },
+                                    "storageAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[parameters('storageAccountName')]"
+                                    },
+                                    "table": {
+                                      "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                    },
+                                    "table_roleAssignments": {
+                                      "copy": {
+                                        "name": "table_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "table"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed file share service."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed file share service."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed file share service."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the deployed table service."
+                              },
+                              "value": "[variables('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the deployed table service."
+                              },
+                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group of the deployed table service."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    },
+                    "secretsExport": {
+                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "keyVaultName": {
+                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                          },
+                          "secretsToSet": {
+                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "9368972709899985618"
+                            }
+                          },
+                          "definitions": {
+                            "secretSetOutputType": {
+                              "type": "object",
+                              "properties": {
+                                "secretResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The resourceId of the exported secret."
+                                  }
+                                },
+                                "secretUri": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI of the exported secret."
+                                  }
+                                },
+                                "secretUriWithVersion": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "The secret URI with version of the exported secret."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "secretToSetType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the secret to set."
+                                  }
+                                },
+                                "value": {
+                                  "type": "securestring",
+                                  "metadata": {
+                                    "description": "Required. The value of the secret to set."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "keyVaultName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                              }
+                            },
+                            "secretsToSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretToSetType"
+                              },
+                              "metadata": {
+                                "description": "Required. The secrets to set in the Key Vault."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "keyVault": {
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "name": "[parameters('keyVaultName')]"
+                            },
+                            "secrets": {
+                              "copy": {
+                                "name": "secrets",
+                                "count": "[length(parameters('secretsToSet'))]"
+                              },
+                              "type": "Microsoft.KeyVault/vaults/secrets",
+                              "apiVersion": "2024-11-01",
+                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                              "properties": {
+                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "secretsSet": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/secretSetOutputType"
+                              },
+                              "metadata": {
+                                "description": "The references to the secrets exported to the provided Key Vault."
+                              },
+                              "copy": {
+                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                "input": {
+                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                }
+                              }
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the deployed storage account."
+                      },
+                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the deployed storage account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group of the deployed storage account."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "primaryBlobEndpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The primary blob endpoint reference if blob services are deployed."
+                      },
+                      "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('storageAccount', '2024-01-01', 'full').location]"
+                    },
+                    "serviceEndpoints": {
+                      "type": "object",
+                      "metadata": {
+                        "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
+                      },
+                      "value": "[reference('storageAccount').primaryEndpoints]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the Storage Account."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "exportedSecrets": {
+                      "$ref": "#/definitions/secretsOutputType",
+                      "metadata": {
+                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                      },
+                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                    },
+                    "primaryAccessKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary access key of the storage account."
+                      },
+                      "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]"
+                    },
+                    "secondaryAccessKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary access key of the storage account."
+                      },
+                      "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]"
+                    },
+                    "primaryConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary connection string of the storage account."
+                      },
+                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]"
+                    },
+                    "secondaryConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary connection string of the storage account."
+                      },
+                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('storageAccount').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "value": "[format('{0}.storageAccount', deployment().name)]"
+            },
+            "primaryBlobEndpoint": {
+              "type": "string",
+              "value": "[reference('storageAccount').outputs.primaryBlobEndpoint.value]"
+            },
+            "primaryQueueEndpoint": {
+              "type": "string",
+              "value": "[format('https://{0}.queue.{1}/', reference('storageAccount').outputs.name.value, environment().suffixes.storage)]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "value": "[reference('storageAccount').outputs.privateEndpoints.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalytics",
+        "queueDnsZone",
+        "userAssignedIdentity"
+      ]
+    },
+    "cosmos": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('cosmos-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "location": {
+            "value": "[parameters('cosmosLocation')]"
+          },
+          "cosmosAccountName": {
+            "value": "[variables('cosmosAccountName')]"
+          },
+          "cosmosDbName": {
+            "value": "[parameters('cosmosDbName')]"
+          },
+          "cosmosDBContainerNames": {
+            "value": "[parameters('cosmosDBContainerNames')]"
+          },
+          "cosmosDBDataContributorPrincipalIds": "[if(not(empty(parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value, parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value)))]",
+          "zoneRedundant": {
+            "value": false
+          },
+          "enablePrivateEndpoint": {
+            "value": "[variables('isAILZIntegrated')]"
+          },
+          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
+          "cosmosPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.cosmos), createObject('value', ''))]",
+          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "3202396039492631389"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location for cosmos DB resources"
+              }
+            },
+            "cosmosAccountName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required: Cosmos DB account name"
+              }
+            },
+            "cosmosDbName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required: Cosmos DB database name"
+              }
+            },
+            "cosmosDBContainerNames": {
+              "type": "array",
+              "metadata": {
+                "description": "Required: Cosmos DB container names used in the application"
+              }
+            },
+            "cosmosDBDataContributorPrincipalIds": {
+              "type": "array",
+              "metadata": {
+                "description": "Required: List of principal IDs (managed identity or user) to be assigned Cosmos DB SQL Data Contributor role"
+              }
+            },
+            "zoneRedundant": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional: Enable zone redundancy for Cosmos DB account. Defaults to false."
+              }
+            },
+            "enablePrivateEndpoint": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional: Enable private endpoint for AILZ integrated mode. Defaults to false."
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional: Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "cosmosPrivateDnsZoneId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Optional: Cosmos DB Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Optional: Public network access setting (used in AILZ integrated mode). Defaults to Enabled."
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional: Tags for resources"
+              }
+            }
+          },
+          "resources": {
+            "cosmosAccount": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}.cosmosAccount', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('cosmosAccountName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "capabilitiesToAdd": {
+                    "value": [
+                      "EnableServerless"
+                    ]
+                  },
+                  "databaseAccountOfferType": {
+                    "value": "Standard"
+                  },
+                  "disableLocalAuthentication": {
+                    "value": true
+                  },
+                  "automaticFailover": {
+                    "value": false
+                  },
+                  "enableMultipleWriteLocations": {
+                    "value": false
+                  },
+                  "enableFreeTier": {
+                    "value": false
+                  },
+                  "defaultConsistencyLevel": {
+                    "value": "Session"
+                  },
+                  "backupPolicyContinuousTier": {
+                    "value": "Continuous7Days"
+                  },
+                  "networkRestrictions": {
+                    "value": {
+                      "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                      "networkAclBypass": "AzureServices",
+                      "ipRules": []
+                    }
+                  },
+                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-pe', parameters('cosmosAccountName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'Sql', 'privateLinkServiceConnectionName', format('{0}-cosmos-plsc', parameters('cosmosAccountName')), 'privateDnsZoneGroup', if(not(empty(parameters('cosmosPrivateDnsZoneId'))), createObject('name', 'cosmos-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'cosmos-config', 'privateDnsZoneResourceId', parameters('cosmosPrivateDnsZoneId')))), null())))), createObject('value', createArray()))]",
+                  "zoneRedundant": {
+                    "value": "[parameters('zoneRedundant')]"
+                  },
+                  "sqlDatabases": {
+                    "value": [
+                      {
+                        "copy": [
+                          {
+                            "name": "containers",
+                            "count": "[length(parameters('cosmosDBContainerNames'))]",
+                            "input": {
+                              "name": "[parameters('cosmosDBContainerNames')[copyIndex('containers')].name]",
+                              "paths": [
+                                "[parameters('cosmosDBContainerNames')[copyIndex('containers')].partitionKey]"
+                              ],
+                              "kind": "Hash"
+                            }
+                          }
+                        ],
+                        "name": "[parameters('cosmosDbName')]"
+                      }
+                    ]
+                  },
+                  "dataPlaneRoleDefinitions": {
+                    "value": [
+                      {
+                        "copy": [
+                          {
+                            "name": "assignments",
+                            "count": "[length(parameters('cosmosDBDataContributorPrincipalIds'))]",
+                            "input": {
+                              "principalId": "[parameters('cosmosDBDataContributorPrincipalIds')[copyIndex('assignments')]]"
+                            }
+                          }
+                        ],
+                        "roleName": "Cosmos DB SQL Data Contributor",
+                        "dataActions": [
+                          "Microsoft.DocumentDB/databaseAccounts/readMetadata",
+                          "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*",
+                          "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*"
+                        ]
+                      }
+                    ]
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.37.4.10188",
+                      "templateHash": "17715929342484596741"
+                    },
+                    "name": "Azure Cosmos DB account",
+                    "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group ID for the private endpoint group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses for the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the private endpoint output."
+                      }
+                    },
+                    "failoverLocationType": {
+                      "type": "object",
+                      "properties": {
+                        "failoverPriority": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
+                          }
+                        },
+                        "isZoneRedundant": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true."
+                          }
+                        },
+                        "locationName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the region."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the failover location."
+                      }
+                    },
+                    "dataPlaneRoleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique name of the role assignment."
+                          }
+                        },
+                        "roleDefinitionId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment."
+                      }
+                    },
+                    "dataPlaneRoleDefinitionType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The unique identifier of the role-based access control definition."
+                          }
+                        },
+                        "roleName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account."
+                          }
+                        },
+                        "dataActions": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of data actions that are allowed."
+                          }
+                        },
+                        "assignableScopes": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope."
+                          }
+                        },
+                        "assignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/sqlRoleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. An array of role-based access control assignments to be created for the definition."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition."
+                      }
+                    },
+                    "sqlDatabaseType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the database ."
+                          }
+                        },
+                        "throughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400."
+                          }
+                        },
+                        "autoscaleSettingsMaxThroughput": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                          }
+                        },
+                        "containers": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of the container."
+                                }
+                              },
+                              "paths": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "minLength": 1,
+                                "maxLength": 3,
+                                "metadata": {
+                                  "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                }
+                              },
+                              "analyticalStorageTtl": {
+                                "type": "int",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                }
+                              },
+                              "autoscaleSettingsMaxThroughput": {
+                                "type": "int",
+                                "nullable": true,
+                                "maxValue": 1000000,
+                                "metadata": {
+                                  "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
+                                }
+                              },
+                              "conflictResolutionPolicy": {
+                                "type": "object",
+                                "properties": {
+                                  "conflictResolutionPath": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
+                                    }
+                                  },
+                                  "conflictResolutionProcedure": {
+                                    "type": "string",
+                                    "nullable": true,
+                                    "metadata": {
+                                      "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
+                                    }
+                                  },
+                                  "mode": {
+                                    "type": "string",
+                                    "allowedValues": [
+                                      "Custom",
+                                      "LastWriterWins"
+                                    ],
+                                    "metadata": {
+                                      "description": "Required. Indicates the conflict resolution mode."
+                                    }
+                                  }
+                                },
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                }
+                              },
+                              "defaultTtl": {
+                                "type": "int",
+                                "nullable": true,
+                                "minValue": -1,
+                                "maxValue": 2147483647,
+                                "metadata": {
+                                  "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                }
+                              },
+                              "indexingPolicy": {
+                                "type": "object",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Indexing policy of the container."
+                                }
+                              },
+                              "kind": {
+                                "type": "string",
+                                "allowedValues": [
+                                  "Hash",
+                                  "MultiHash"
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                }
+                              },
+                              "version": {
+                                "type": "int",
+                                "allowedValues": [
+                                  1,
+                                  2
+                                ],
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                }
+                              },
+                              "throughput": {
+                                "type": "int",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
+                                }
+                              },
+                              "uniqueKeyPolicyKeys": {
+                                "type": "array",
+                                "items": {
+                                  "type": "object",
+                                  "properties": {
+                                    "paths": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
+                                      }
+                                    }
+                                  }
+                                },
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Set of containers to deploy in the database."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an Azure Cosmos DB for NoSQL database."
+                      }
+                    },
+                    "networkRestrictionType": {
+                      "type": "object",
+                      "properties": {
+                        "ipRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`."
+                          }
+                        },
+                        "networkAclBypass": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureServices",
+                            "None"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"."
+                          }
+                        },
+                        "publicNetworkAccess": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"."
+                          }
+                        },
+                        "virtualNetworkRules": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "subnetResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Resource ID of a subnet."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. List of virtual network access control list (ACL) rules configured for the account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the network restriction."
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "privateEndpointMultiServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the private endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "sqlRoleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the SQL Role Assignments.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "sql-role-definition/main.bicep"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. The name of the account."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Defaults to the current resource group scope location. Location for all resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags"
+                        },
+                        "description": "Optional. Tags for the resource."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "databaseAccountOfferType": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The offer type for the account. Defaults to \"Standard\"."
+                      }
+                    },
+                    "failoverLocations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/failoverLocationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts."
+                      }
+                    },
+                    "defaultConsistencyLevel": {
+                      "type": "string",
+                      "defaultValue": "Session",
+                      "allowedValues": [
+                        "Eventual",
+                        "ConsistentPrefix",
+                        "Session",
+                        "BoundedStaleness",
+                        "Strong"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The default consistency level of the account. Defaults to \"Session\"."
+                      }
+                    },
+                    "disableLocalAuthentication": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true."
+                      }
+                    },
+                    "enableAnalyticalStorage": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false."
+                      }
+                    },
+                    "automaticFailover": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable automatic failover for regions. Defaults to true."
+                      }
+                    },
+                    "enableFreeTier": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false."
+                      }
+                    },
+                    "enableMultipleWriteLocations": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false."
+                      }
+                    },
+                    "disableKeyBasedMetadataWriteAccess": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true."
+                      }
+                    },
+                    "maxStalenessPrefix": {
+                      "type": "int",
+                      "defaultValue": 100000,
+                      "minValue": 1,
+                      "maxValue": 2147483647,
+                      "metadata": {
+                        "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000."
+                      }
+                    },
+                    "maxIntervalInSeconds": {
+                      "type": "int",
+                      "defaultValue": 300,
+                      "minValue": 5,
+                      "maxValue": 86400,
+                      "metadata": {
+                        "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300."
+                      }
+                    },
+                    "serverVersion": {
+                      "type": "string",
+                      "defaultValue": "4.2",
+                      "allowedValues": [
+                        "3.2",
+                        "3.6",
+                        "4.0",
+                        "4.2",
+                        "5.0",
+                        "6.0",
+                        "7.0"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"."
+                      }
+                    },
+                    "sqlDatabases": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/sqlDatabaseType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL."
+                      }
+                    },
+                    "mongodbDatabases": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU."
+                      }
+                    },
+                    "gremlinDatabases": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin."
+                      }
+                    },
+                    "tables": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "totalThroughputLimit": {
+                      "type": "int",
+                      "defaultValue": -1,
+                      "metadata": {
+                        "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. An array of control plane Azure role-based access control assignments."
+                      }
+                    },
+                    "dataPlaneRoleDefinitions": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataPlaneRoleDefinitionType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions."
+                      }
+                    },
+                    "dataPlaneRoleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/dataPlaneRoleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings for the service."
+                      }
+                    },
+                    "capabilitiesToAdd": {
+                      "type": "array",
+                      "items": {
+                        "type": "string"
+                      },
+                      "nullable": true,
+                      "allowedValues": [
+                        "EnableCassandra",
+                        "EnableTable",
+                        "EnableGremlin",
+                        "EnableMongo",
+                        "DisableRateLimitingResponses",
+                        "EnableServerless",
+                        "EnableNoSQLVectorSearch",
+                        "EnableNoSQLFullTextSearch",
+                        "EnableMaterializedViews",
+                        "DeleteAllItemsByPartitionKey"
+                      ],
+                      "metadata": {
+                        "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account."
+                      }
+                    },
+                    "backupPolicyType": {
+                      "type": "string",
+                      "defaultValue": "Continuous",
+                      "allowedValues": [
+                        "Periodic",
+                        "Continuous"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"."
+                      }
+                    },
+                    "backupPolicyContinuousTier": {
+                      "type": "string",
+                      "defaultValue": "Continuous30Days",
+                      "allowedValues": [
+                        "Continuous30Days",
+                        "Continuous7Days"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"."
+                      }
+                    },
+                    "backupIntervalInMinutes": {
+                      "type": "int",
+                      "defaultValue": 240,
+                      "minValue": 60,
+                      "maxValue": 1440,
+                      "metadata": {
+                        "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240."
+                      }
+                    },
+                    "backupRetentionIntervalInHours": {
+                      "type": "int",
+                      "defaultValue": 8,
+                      "minValue": 2,
+                      "maxValue": 720,
+                      "metadata": {
+                        "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8."
+                      }
+                    },
+                    "backupStorageRedundancy": {
+                      "type": "string",
+                      "defaultValue": "Local",
+                      "allowedValues": [
+                        "Geo",
+                        "Local",
+                        "Zone"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointMultiServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible."
+                      }
+                    },
+                    "networkRestrictions": {
+                      "$ref": "#/definitions/networkRestrictionType",
+                      "defaultValue": {
+                        "ipRules": [],
+                        "virtualNetworkRules": [],
+                        "publicNetworkAccess": "Disabled"
+                      },
+                      "metadata": {
+                        "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
+                      }
+                    },
+                    "minimumTlsVersion": {
+                      "type": "string",
+                      "defaultValue": "Tls12",
+                      "allowedValues": [
+                        "Tls12"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInControlPlaneRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
+                      "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
+                      "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
+                      "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
+                      "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-07-01",
+                      "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "databaseAccount": {
+                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                      "apiVersion": "2024-11-15",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]",
+                      "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]"
+                    },
+                    "databaseAccount_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_diagnosticSettings": {
+                      "copy": {
+                        "name": "databaseAccount_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_roleAssignments": {
+                      "copy": {
+                        "name": "databaseAccount_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_sqlDatabases": {
+                      "copy": {
+                        "name": "databaseAccount_sqlDatabases",
+                        "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]"
+                          },
+                          "containers": {
+                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]"
+                          },
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "autoscaleSettingsMaxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "7141543733238879531"
+                            },
+                            "name": "DocumentDB Database Account SQL Databases",
+                            "description": "This module deploys a SQL Database in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the SQL database ."
+                              }
+                            },
+                            "containers": {
+                              "type": "array",
+                              "items": {
+                                "type": "object"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of containers to deploy in the SQL database."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                              }
+                            },
+                            "autoscaleSettingsMaxThroughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the SQL database resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "sqlDatabase": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                },
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "container": {
+                              "copy": {
+                                "name": "container",
+                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "sqlDatabaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                  },
+                                  "analyticalStorageTtl": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]"
+                                  },
+                                  "autoscaleSettingsMaxThroughput": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                  },
+                                  "conflictResolutionPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]"
+                                  },
+                                  "defaultTtl": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]"
+                                  },
+                                  "indexingPolicy": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]"
+                                  },
+                                  "kind": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]"
+                                  },
+                                  "version": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]"
+                                  },
+                                  "paths": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]"
+                                  },
+                                  "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]",
+                                  "uniqueKeyPolicyKeys": {
+                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "1789954443166349986"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Database Containers",
+                                    "description": "This module deploys a SQL Database Container in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "sqlDatabaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the container."
+                                      }
+                                    },
+                                    "analyticalStorageTtl": {
+                                      "type": "int",
+                                      "defaultValue": 0,
+                                      "metadata": {
+                                        "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                      }
+                                    },
+                                    "conflictResolutionPolicy": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                      }
+                                    },
+                                    "defaultTtl": {
+                                      "type": "int",
+                                      "defaultValue": -1,
+                                      "minValue": -1,
+                                      "maxValue": 2147483647,
+                                      "metadata": {
+                                        "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "defaultValue": 400,
+                                      "metadata": {
+                                        "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                      }
+                                    },
+                                    "autoscaleSettingsMaxThroughput": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "maxValue": 1000000,
+                                      "metadata": {
+                                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the SQL Database resource."
+                                      }
+                                    },
+                                    "paths": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 3,
+                                      "metadata": {
+                                        "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                      }
+                                    },
+                                    "indexingPolicy": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Indexing policy of the container."
+                                      }
+                                    },
+                                    "uniqueKeyPolicyKeys": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "Hash",
+                                      "allowedValues": [
+                                        "Hash",
+                                        "MultiHash"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                      }
+                                    },
+                                    "version": {
+                                      "type": "int",
+                                      "defaultValue": 1,
+                                      "allowedValues": [
+                                        1,
+                                        2
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "partitionKeyPaths",
+                                        "count": "[length(parameters('paths'))]",
+                                        "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
+                                      }
+                                    ],
+                                    "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
+                                  },
+                                  "resources": {
+                                    "databaseAccount::sqlDatabase": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "container": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": "[variables('containerResourceParams')]",
+                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the container."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the container."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the container was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "sqlDatabase"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_sqlRoleDefinitions": {
+                      "copy": {
+                        "name": "databaseAccount_sqlRoleDefinitions",
+                        "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "dataActions": {
+                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
+                          },
+                          "roleName": {
+                            "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]"
+                          },
+                          "assignableScopes": {
+                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
+                          },
+                          "sqlRoleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "9570871897890815068"
+                            },
+                            "name": "DocumentDB Database Account SQL Role Definitions.",
+                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
+                          },
+                          "definitions": {
+                            "sqlRoleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the SQL Role Assignments."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The unique identifier of the Role Definition."
+                              }
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
+                              }
+                            },
+                            "dataActions": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. An array of data actions that are allowed."
+                              }
+                            },
+                            "assignableScopes": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
+                              }
+                            },
+                            "sqlRoleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/sqlRoleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "enableReferencedModulesTelemetry": false
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "sqlRoleDefinition": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]",
+                              "properties": {
+                                "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
+                                "permissions": [
+                                  {
+                                    "dataActions": "[parameters('dataActions')]"
+                                  }
+                                ],
+                                "roleName": "[parameters('roleName')]",
+                                "type": "CustomRole"
+                              }
+                            },
+                            "databaseAccount_sqlRoleAssignments": {
+                              "copy": {
+                                "name": "databaseAccount_sqlRoleAssignments",
+                                "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "roleDefinitionId": {
+                                    "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
+                                  },
+                                  "principalId": {
+                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                  },
+                                  "name": {
+                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "10102303164433641479"
+                                    },
+                                    "name": "DocumentDB Database Account SQL Role Assignments.",
+                                    "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                      }
+                                    },
+                                    "principalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                      }
+                                    },
+                                    "roleDefinitionId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The unique identifier of the associated SQL Role Definition."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "sqlRoleAssignment": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                                      "properties": {
+                                        "principalId": "[parameters('principalId')]",
+                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the SQL Role Assignment."
+                                      },
+                                      "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the SQL Role Assignment."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the SQL Role Definition was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "sqlRoleDefinition"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL Role Definition."
+                              },
+                              "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL Role Definition."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL Role Definition was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "roleName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The role name of the SQL Role Definition."
+                              },
+                              "value": "[reference('sqlRoleDefinition').roleName]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_sqlRoleAssignments": {
+                      "copy": {
+                        "name": "databaseAccount_sqlRoleAssignments",
+                        "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "roleDefinitionId": {
+                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                          },
+                          "principalId": {
+                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "10102303164433641479"
+                            },
+                            "name": "DocumentDB Database Account SQL Role Assignments.",
+                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                              }
+                            },
+                            "principalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                              }
+                            },
+                            "roleDefinitionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The unique identifier of the associated SQL Role Definition."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "sqlRoleAssignment": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                              "properties": {
+                                "principalId": "[parameters('principalId')]",
+                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the SQL Role Assignment."
+                              },
+                              "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the SQL Role Assignment."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the SQL Role Definition was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_mongodbDatabases": {
+                      "copy": {
+                        "name": "databaseAccount_mongodbDatabases",
+                        "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "collections": {
+                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "9160691107424630312"
+                            },
+                            "name": "DocumentDB Database Account MongoDB Databases",
+                            "description": "This module deploys a MongoDB Database within a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the mongodb database."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "defaultValue": 400,
+                              "metadata": {
+                                "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                              }
+                            },
+                            "collections": {
+                              "type": "array",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Collections in the mongodb database."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "mongodbDatabase": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                },
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "mongodbDatabase_collections": {
+                              "copy": {
+                                "name": "mongodbDatabase_collections",
+                                "count": "[length(coalesce(parameters('collections'), createArray()))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "mongodbDatabaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "name": {
+                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]"
+                                  },
+                                  "indexes": {
+                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]"
+                                  },
+                                  "shardKey": {
+                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]"
+                                  },
+                                  "throughput": {
+                                    "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "14050805189442830205"
+                                    },
+                                    "name": "DocumentDB Database Account MongoDB Database Collections",
+                                    "description": "This module deploys a MongoDB Database Collection."
+                                  },
+                                  "parameters": {
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "mongodbDatabaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the collection."
+                                      }
+                                    },
+                                    "throughput": {
+                                      "type": "int",
+                                      "defaultValue": 400,
+                                      "metadata": {
+                                        "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                      }
+                                    },
+                                    "indexes": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "description": "Required. Indexes for the collection."
+                                      }
+                                    },
+                                    "shardKey": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "description": "Required. ShardKey for the collection."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
+                                      "properties": {
+                                        "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
+                                        "resource": {
+                                          "id": "[parameters('name')]",
+                                          "indexes": "[parameters('indexes')]",
+                                          "shardKey": "[parameters('shardKey')]"
+                                        }
+                                      }
+                                    }
+                                  ],
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the mongodb database collection."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the mongodb database collection."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the mongodb database collection was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "mongodbDatabase"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the mongodb database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the mongodb database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the mongodb database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_gremlinDatabases": {
+                      "copy": {
+                        "name": "databaseAccount_gremlinDatabases",
+                        "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "graphs": {
+                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]"
+                          },
+                          "maxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "16834580070429190924"
+                            },
+                            "name": "DocumentDB Database Account Gremlin Databases",
+                            "description": "This module deploys a Gremlin Database within a CosmosDB Account."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Gremlin database."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the Gremlin database resource."
+                              }
+                            },
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "graphs": {
+                              "type": "array",
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                              }
+                            },
+                            "maxThroughput": {
+                              "type": "int",
+                              "defaultValue": 4000,
+                              "metadata": {
+                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "gremlinDatabase": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            },
+                            "gremlinDatabase_gremlinGraphs": {
+                              "copy": {
+                                "name": "gremlinDatabase_gremlinGraphs",
+                                "count": "[length(parameters('graphs'))]"
+                              },
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('graphs')[copyIndex()].name]"
+                                  },
+                                  "gremlinDatabaseName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "databaseAccountName": {
+                                    "value": "[parameters('databaseAccountName')]"
+                                  },
+                                  "indexingPolicy": {
+                                    "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
+                                  },
+                                  "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "15062578211366932944"
+                                    },
+                                    "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
+                                    "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the graph."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the Gremlin graph resource."
+                                      }
+                                    },
+                                    "databaseAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "gremlinDatabaseName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "indexingPolicy": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Indexing policy of the graph."
+                                      }
+                                    },
+                                    "partitionKeyPaths": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. List of paths using which data within the container can be partitioned."
+                                      }
+                                    }
+                                  },
+                                  "resources": {
+                                    "databaseAccount::gremlinDatabase": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
+                                    },
+                                    "databaseAccount": {
+                                      "existing": true,
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('databaseAccountName')]"
+                                    },
+                                    "gremlinGraph": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "resource": {
+                                          "id": "[parameters('name')]",
+                                          "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
+                                          "partitionKey": {
+                                            "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
+                                          }
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the graph."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the graph."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the graph was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "gremlinDatabase"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Gremlin database."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Gremlin database."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the Gremlin database was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_tables": {
+                      "copy": {
+                        "name": "databaseAccount_tables",
+                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "databaseAccountName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "maxThroughput": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]"
+                          },
+                          "throughput": {
+                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "3429971823201332257"
+                            },
+                            "name": "Azure Cosmos DB account tables",
+                            "description": "This module deploys a table within an Azure Cosmos DB Account."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the table."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags for the table."
+                              }
+                            },
+                            "databaseAccountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "maxThroughput": {
+                              "type": "int",
+                              "defaultValue": 4000,
+                              "metadata": {
+                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                              }
+                            },
+                            "throughput": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "databaseAccount": {
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2024-11-15",
+                              "name": "[parameters('databaseAccountName')]"
+                            },
+                            "table": {
+                              "type": "Microsoft.DocumentDB/databaseAccounts/tables",
+                              "apiVersion": "2024-11-15",
+                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                "resource": {
+                                  "id": "[parameters('name')]"
+                                }
+                              },
+                              "dependsOn": [
+                                "databaseAccount"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the table."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the table."
+                              },
+                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the table was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    },
+                    "databaseAccount_privateEndpoints": {
+                      "copy": {
+                        "name": "databaseAccount_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "12389807800450456797"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateLinkServiceConnectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the private link service connection."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                      }
+                                    },
+                                    "privateLinkServiceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource id of private link service."
+                                      }
+                                    },
+                                    "requestMessage": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private link service connection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "customDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipConfigurationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              }
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              }
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom DNS configurations."
+                              }
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.34.44.8038",
+                                      "templateHash": "13997305779829540948"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "privateDnsZoneConfigsVar",
+                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                        "input": {
+                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                          "properties": {
+                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "metadata": {
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "databaseAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the database account."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the database account."
+                      },
+                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the database account was created in."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('databaseAccount', '2024-11-15', 'full').location]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The endpoint of the database account."
+                      },
+                      "value": "[reference('databaseAccount').documentEndpoint]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the database account."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    },
+                    "primaryReadWriteKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-write key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]"
+                    },
+                    "primaryReadOnlyKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-only key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]"
+                    },
+                    "primaryReadWriteConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-write connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]"
+                    },
+                    "primaryReadOnlyConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The primary read-only connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]"
+                    },
+                    "secondaryReadWriteKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-write key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]"
+                    },
+                    "secondaryReadOnlyKey": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-only key."
+                      },
+                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]"
+                    },
+                    "secondaryReadWriteConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-write connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]"
+                    },
+                    "secondaryReadOnlyConnectionString": {
+                      "type": "securestring",
+                      "metadata": {
+                        "description": "The secondary read-only connection string."
+                      },
+                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('cosmosAccount').outputs.resourceId.value]"
+            },
+            "cosmosAccountName": {
+              "type": "string",
+              "value": "[format('{0}.cosmosAccount', deployment().name)]"
+            },
+            "cosmosEndpoint": {
+              "type": "string",
+              "value": "[reference('cosmosAccount').outputs.endpoint.value]"
+            },
+            "cosmosDBName": {
+              "type": "string",
+              "value": "[parameters('cosmosDbName')]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "value": "[reference('cosmosAccount').outputs.privateEndpoints.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "userAssignedIdentity"
+      ]
+    },
+    "appConfigStore": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('appConfig-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "appConfigStoreName": {
+            "value": "[variables('appConfigStoreName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "roleAssignedManagedIdentityPrincipalIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.principalId.value]"
+            ]
+          },
+          "enablePrivateEndpoint": {
+            "value": "[variables('isAILZIntegrated')]"
+          },
+          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
+          "appConfigPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.appConfig), createObject('value', ''))]",
+          "publicNetworkAccess": {
+            "value": "Enabled"
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "15550279319246160051"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Location for all resources"
+              }
+            },
+            "appConfigStoreName": {
+              "type": "string",
+              "metadata": {
+                "description": "App Configuration Store name"
+              }
+            },
+            "roleAssignedManagedIdentityPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "Managed Identity that will be given access to the App Configuration Store"
+              }
+            },
+            "enablePrivateEndpoint": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable private endpoint for AILZ mode"
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "appConfigPrivateDnsZoneId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "App Configuration Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Public network access setting"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "roleAssignments",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignments')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "App Configuration Data Reader"
+                }
+              }
+            ],
+            "deployerRoleAssignments": [
+              {
+                "principalId": "[deployer().objectId]",
+                "principalType": "User",
+                "roleDefinitionIdOrName": "App Configuration Data Owner"
+              }
+            ]
+          },
+          "resources": {
+            "appConfigStore": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}-appConfigStore', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('appConfigStoreName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "sku": {
+                    "value": "Standard"
+                  },
+                  "createMode": {
+                    "value": "Default"
+                  },
+                  "disableLocalAuth": {
+                    "value": false
+                  },
+                  "dataPlaneProxy": {
+                    "value": {
+                      "authenticationMode": "Pass-through",
+                      "privateLinkDelegation": "Disabled"
+                    }
+                  },
+                  "enablePurgeProtection": {
+                    "value": false
+                  },
+                  "softDeleteRetentionInDays": {
+                    "value": 1
+                  },
+                  "roleAssignments": {
+                    "value": "[concat(variables('roleAssignments'), variables('deployerRoleAssignments'))]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-pe', parameters('appConfigStoreName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'privateLinkServiceConnectionName', format('{0}-app-config-plsc', parameters('appConfigStoreName')), 'privateDnsZoneGroup', if(not(empty(parameters('appConfigPrivateDnsZoneId'))), createObject('name', 'app-config-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'app-config', 'privateDnsZoneResourceId', parameters('appConfigPrivateDnsZoneId')))), null())))), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.37.4.10188",
+                      "templateHash": "396653159019145335"
+                    },
+                    "name": "App Configuration Stores",
+                    "description": "This module deploys an App Configuration Store."
+                  },
+                  "definitions": {
+                    "dataPlaneProxyType": {
+                      "type": "object",
+                      "properties": {
+                        "authenticationMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Local",
+                            "Pass-through"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The data plane proxy authentication mode. This property manages the authentication mode of request to the data plane resources. 'Pass-through' is recommended."
+                          }
+                        },
+                        "privateLinkDelegation": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "metadata": {
+                            "description": "Required. The data plane proxy private link delegation. This property manages if a request from delegated Azure Resource Manager (ARM) private link is allowed when the data plane resource requires private link."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the data plane proxy."
+                      }
+                    },
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "replicaLocationType": {
+                      "type": "object",
+                      "properties": {
+                        "replicaLocation": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Location of the replica."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the replica."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a replica location"
+                      }
+                    },
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "customerManagedKeyWithAutoRotateType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                          }
+                        },
+                        "autoRotationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Azure App Configuration."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "sku": {
+                      "type": "string",
+                      "defaultValue": "Standard",
+                      "allowedValues": [
+                        "Free",
+                        "Developer",
+                        "Standard",
+                        "Premium"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Pricing tier of App Configuration."
+                      }
+                    },
+                    "createMode": {
+                      "type": "string",
+                      "defaultValue": "Default",
+                      "allowedValues": [
+                        "Default",
+                        "Recover"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Indicates whether the configuration store need to be recovered."
+                      }
+                    },
+                    "disableLocalAuth": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Disables all authentication methods other than AAD authentication."
+                      }
+                    },
+                    "enablePurgeProtection": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Property specifying whether protection against purge is enabled for this configuration store. Defaults to true unless sku is set to Free, since purge protection is not available in Free tier."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
+                      }
+                    },
+                    "softDeleteRetentionInDays": {
+                      "type": "int",
+                      "defaultValue": 1,
+                      "minValue": 1,
+                      "maxValue": 7,
+                      "metadata": {
+                        "description": "Optional. The amount of time in days that the configuration store will be retained when it is soft deleted."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition."
+                      }
+                    },
+                    "keyValues": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. All Key / Values to create. Requires local authentication to be enabled."
+                      }
+                    },
+                    "replicaLocations": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/replicaLocationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. All Replicas to create."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.AppConfiguration/configurationStores@2024-05-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "dataPlaneProxy": {
+                      "$ref": "#/definitions/dataPlaneProxyType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Property specifying the configuration of data plane proxy for Azure Resource Manager (ARM)."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
+                      "App Compliance Automation Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ffc6bbe0-e443-4c3b-bf54-26581bb2f78e')]",
+                      "App Configuration Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b')]",
+                      "App Configuration Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '516239f1-63e1-4d78-a4de-a74fb236a071')]",
+                      "App Configuration Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '175b81b9-6e0d-490a-85e4-0d422273c10c')]",
+                      "App Configuration Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fe86443c-f201-4fc4-9d2a-ac61149fbda0')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('46d3xbcp.res.appconfiguration-configurationstore.{0}.{1}', replace('0.9.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2024-12-01-preview",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "cMKUserAssignedIdentity": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                    },
+                    "configurationStore": {
+                      "type": "Microsoft.AppConfiguration/configurationStores",
+                      "apiVersion": "2025-02-01-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('sku')]"
+                      },
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "createMode": "[parameters('createMode')]",
+                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                        "enablePurgeProtection": "[if(or(equals(parameters('sku'), 'Free'), equals(parameters('sku'), 'Developer')), false(), parameters('enablePurgeProtection'))]",
+                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keyVaultProperties', createObject('keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)), 'identityClientId', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), reference('cMKUserAssignedIdentity').clientId, null()))), null())]",
+                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled'))]",
+                        "softDeleteRetentionInDays": "[if(or(equals(parameters('sku'), 'Free'), equals(parameters('sku'), 'Developer')), 0, parameters('softDeleteRetentionInDays'))]",
+                        "dataPlaneProxy": "[if(not(empty(parameters('dataPlaneProxy'))), createObject('authenticationMode', coalesce(tryGet(parameters('dataPlaneProxy'), 'authenticationMode'), 'Pass-through'), 'privateLinkDelegation', parameters('dataPlaneProxy').privateLinkDelegation), null())]"
+                      },
+                      "dependsOn": [
+                        "cMKKeyVault::cMKKey",
+                        "cMKUserAssignedIdentity"
+                      ]
+                    },
+                    "configurationStore_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.AppConfiguration/configurationStores/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "configurationStore"
+                      ]
+                    },
+                    "configurationStore_diagnosticSettings": {
+                      "copy": {
+                        "name": "configurationStore_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.AppConfiguration/configurationStores/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "configurationStore"
+                      ]
+                    },
+                    "configurationStore_roleAssignments": {
+                      "copy": {
+                        "name": "configurationStore_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.AppConfiguration/configurationStores/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "configurationStore"
+                      ]
+                    },
+                    "configurationStore_keyValues": {
+                      "copy": {
+                        "name": "configurationStore_keyValues",
+                        "count": "[length(coalesce(parameters('keyValues'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-AppConfig-KeyValues-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appConfigurationName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "name": {
+                            "value": "[coalesce(parameters('keyValues'), createArray())[copyIndex()].name]"
+                          },
+                          "value": {
+                            "value": "[coalesce(parameters('keyValues'), createArray())[copyIndex()].value]"
+                          },
+                          "contentType": {
+                            "value": "[tryGet(coalesce(parameters('keyValues'), createArray())[copyIndex()], 'contentType')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('keyValues'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "4166303424618131775"
+                            },
+                            "name": "App Configuration Stores Key Values",
+                            "description": "This module deploys an App Configuration Store Key Value."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the key."
+                              }
+                            },
+                            "value": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The value of the key-value."
+                              }
+                            },
+                            "appConfigurationName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent app configuration store. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "contentType": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The content type of the key-values value. Providing a proper content-type can enable transformations of values when they are retrieved by applications."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "appConfiguration": {
+                              "existing": true,
+                              "type": "Microsoft.AppConfiguration/configurationStores",
+                              "apiVersion": "2025-02-01-preview",
+                              "name": "[parameters('appConfigurationName')]"
+                            },
+                            "keyValues": {
+                              "type": "Microsoft.AppConfiguration/configurationStores/keyValues",
+                              "apiVersion": "2025-02-01-preview",
+                              "name": "[format('{0}/{1}', parameters('appConfigurationName'), parameters('name'))]",
+                              "properties": {
+                                "contentType": "[parameters('contentType')]",
+                                "tags": "[parameters('tags')]",
+                                "value": "[parameters('value')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the key values."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the key values."
+                              },
+                              "value": "[resourceId('Microsoft.AppConfiguration/configurationStores/keyValues', parameters('appConfigurationName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the batch account was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "configurationStore"
+                      ]
+                    },
+                    "configurationStore_replicas": {
+                      "copy": {
+                        "name": "configurationStore_replicas",
+                        "count": "[length(coalesce(parameters('replicaLocations'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-AppConfig-Replicas-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "appConfigurationName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "replicaLocation": {
+                            "value": "[coalesce(parameters('replicaLocations'), createArray())[copyIndex()].replicaLocation]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('replicaLocations'), createArray())[copyIndex()], 'name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "12609356088985615301"
+                            },
+                            "name": "App Configuration Replicas",
+                            "description": "This module deploys an App Configuration Replica."
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}replica', parameters('replicaLocation'))]",
+                              "metadata": {
+                                "description": "Optional. Name of the replica."
+                              }
+                            },
+                            "appConfigurationName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent app configuration store. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "replicaLocation": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Location of the replica."
+                              }
+                            }
+                          },
+                          "resources": [
+                            {
+                              "type": "Microsoft.AppConfiguration/configurationStores/replicas",
+                              "apiVersion": "2025-02-01-preview",
+                              "name": "[format('{0}/{1}', parameters('appConfigurationName'), parameters('name'))]",
+                              "location": "[parameters('replicaLocation')]"
+                            }
+                          ],
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the app configuration was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the replica that was deployed."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the replica that was deployed."
+                              },
+                              "value": "[resourceId('Microsoft.AppConfiguration/configurationStores/replicas', parameters('appConfigurationName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "configurationStore"
+                      ]
+                    },
+                    "configurationStore_privateEndpoints": {
+                      "copy": {
+                        "name": "configurationStore_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "mode": "serial",
+                        "batchSize": 1
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-configStore-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "12389807800450456797"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateLinkServiceConnectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the private link service connection."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                      }
+                                    },
+                                    "privateLinkServiceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource id of private link service."
+                                      }
+                                    },
+                                    "requestMessage": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private link service connection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "customDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipConfigurationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              }
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              }
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom DNS configurations."
+                              }
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.34.44.8038",
+                                      "templateHash": "13997305779829540948"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "privateDnsZoneConfigsVar",
+                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                        "input": {
+                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                          "properties": {
+                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "metadata": {
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "configurationStore"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the app configuration."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the app configuration."
+                      },
+                      "value": "[resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name'))]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource group the app configuration store was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('configurationStore', '2025-02-01-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('configurationStore', '2025-02-01-preview', 'full').location]"
+                    },
+                    "endpoint": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The endpoint of the app configuration."
+                      },
+                      "value": "[reference('configurationStore').endpoint]"
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the app configuration."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "endpoint": {
+              "type": "string",
+              "value": "[reference('appConfigStore').outputs.endpoint.value]"
+            },
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('appConfigStore').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "value": "[reference('appConfigStore').outputs.name.value]"
+            },
+            "privateEndpointIds": {
+              "type": "array",
+              "value": "[reference('appConfigStore').outputs.privateEndpoints.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "userAssignedIdentity"
+      ]
+    },
+    "appConfigStoreKeys": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('appConfigKeys-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "appConfigStoreName": {
+            "value": "[variables('appConfigStoreName')]"
+          },
+          "configurationKeyValues": {
+            "value": [
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.common.COSMOS_DB_ENDPOINT",
+                "value": "[reference('cosmos').outputs.cosmosEndpoint.value]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.common.COSMOS_DB_NAME",
+                "value": "[parameters('cosmosDbName')]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.common.BLOB_STORAGE_ACCOUNT_NAME",
+                "value": "[variables('storageAccountName')]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.common.BLOB_STORAGE_CONTAINER_NAME",
+                "value": "[parameters('docsContainerName')]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.common.STORAGE_ACCOUNT_WORKER_QUEUE_URL",
+                "value": "[reference('storage').outputs.primaryQueueEndpoint.value]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.common.STORAGE_WORKER_QUEUE_NAME",
+                "value": "[parameters('workerQueueName')]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.API_ENABLED",
+                "value": "True"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.DEBUG",
+                "value": "False"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.LOG_LEVEL",
+                "value": "DEBUG"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.API_SERVER_HOST",
+                "value": "0.0.0.0"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.API_SERVER_PORT",
+                "value": "[format('{0}', parameters('apiContainerAppTargetPort'))]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.API_SERVER_WORKERS",
+                "value": "1"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.CORS_ALLOW_CREDENTIALS",
+                "value": "true"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.api.CORS_ALLOW_ORIGINS",
+                "value": "*"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.NUM_PROCESSING_WORKERS",
+                "value": "4"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.NUM_SOURCE_WORKERS",
+                "value": "2"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.LOG_LEVEL",
+                "value": "INFO"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.DEBUG",
+                "value": "false"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.API_ENABLED",
+                "value": "[format('{0}', parameters('workerAPIEnabled'))]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.API_HOST",
+                "value": "0.0.0.0"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.API_PORT",
+                "value": "[format('{0}', parameters('workerContainerAppTargetPort'))]"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.QUEUE_POLL_INTERVAL_SECONDS",
+                "value": "5"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.QUEUE_VISIBILITY_TIMEOUT_SECONDS",
+                "value": "300"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.QUEUE_MAX_MESSAGES",
+                "value": "32"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.MAX_TASK_RETRIES",
+                "value": "3"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.TASK_TIMEOUT_SECONDS",
+                "value": "600"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.DEFAULT_POLLING_INTERVAL_SECONDS",
+                "value": "60"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.SCHEDULER_SLEEP_INTERVAL_SECONDS",
+                "value": "5"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "contentflow.worker.LOCK_TTL_SECONDS",
+                "value": "300"
+              },
+              {
+                "contentType": "text/plain",
+                "name": "sentinel",
+                "value": "1"
+              }
+            ]
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "1913114762964844419"
+            }
+          },
+          "parameters": {
+            "appConfigStoreName": {
+              "type": "string"
+            },
+            "configurationKeyValues": {
+              "type": "array"
+            }
+          },
+          "resources": [
+            {
+              "copy": {
+                "name": "keyValues",
+                "count": "[length(parameters('configurationKeyValues'))]"
+              },
+              "type": "Microsoft.AppConfiguration/configurationStores/keyValues",
+              "apiVersion": "2024-06-01",
+              "name": "[format('{0}/{1}', parameters('appConfigStoreName'), parameters('configurationKeyValues')[copyIndex()].name)]",
+              "properties": {
+                "value": "[parameters('configurationKeyValues')[copyIndex()].value]",
+                "contentType": "[parameters('configurationKeyValues')[copyIndex()].contentType]"
+              }
+            }
+          ]
+        }
+      },
+      "dependsOn": [
+        "appConfigStore",
+        "cosmos",
+        "storage"
+      ]
+    },
+    "containerRegistry": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('acr-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "containerRegistryName": {
+            "value": "[variables('containerRegistryName')]"
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "roleAssignedManagedIdentityPrincipalIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.principalId.value]"
+            ]
+          },
+          "enablePrivateEndpoint": {
+            "value": "[variables('isAILZIntegrated')]"
+          },
+          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
+          "acrPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.acr), createObject('value', ''))]",
+          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "11955792242736172531"
+            }
+          },
+          "parameters": {
+            "containerRegistryName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required: Name of the Container Registry"
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional: Location for all resources. Default is the resource group location"
+              }
+            },
+            "sku": {
+              "type": "string",
+              "defaultValue": "Standard",
+              "allowedValues": [
+                "Basic",
+                "Premium",
+                "Standard"
+              ],
+              "metadata": {
+                "description": "Optional: Container Registry SKU. Default is Standard, Premium required for private endpoints"
+              }
+            },
+            "adminUserEnabled": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Optional: Admin user enabled. Default is false"
+              }
+            },
+            "enablePrivateEndpoint": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable private endpoint for AILZ integrated mode"
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "acrPrivateDnsZoneId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Azure Container Registry Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Public network access setting for the Azure Container Registry"
+              }
+            },
+            "zoneRedundancy": {
+              "type": "string",
+              "defaultValue": "Disabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Zone redundancy setting for the Azure Container Registry"
+              }
+            },
+            "roleAssignedManagedIdentityPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "Managed Identity that will be given access to the Container Registry"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Optional: Tags for resources"
+              }
+            }
+          },
+          "variables": {
+            "copy": [
+              {
+                "name": "roleAssignmentsAcrPull",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPull')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "AcrPull"
+                }
+              },
+              {
+                "name": "roleAssignmentsAcrPush",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPush')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "AcrPush"
+                }
+              },
+              {
+                "name": "roleAssignmentsAcrDelete",
+                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
+                "input": {
+                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrDelete')]]",
+                  "principalType": "ServicePrincipal",
+                  "roleDefinitionIdOrName": "AcrDelete"
+                }
+              }
+            ]
+          },
+          "resources": {
+            "containerRegistry": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('containerRegistry-{0}', uniqueString('containerRegistry', deployment().name))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('containerRegistryName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "acrSku": "[if(parameters('enablePrivateEndpoint'), createObject('value', 'Premium'), createObject('value', parameters('sku')))]",
+                  "acrAdminUserEnabled": {
+                    "value": "[parameters('adminUserEnabled')]"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "zoneRedundancy": {
+                    "value": "[parameters('zoneRedundancy')]"
+                  },
+                  "roleAssignments": {
+                    "value": "[concat(variables('roleAssignmentsAcrPull'), variables('roleAssignmentsAcrPush'), variables('roleAssignmentsAcrDelete'))]"
+                  },
+                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-pe', parameters('containerRegistryName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'registry', 'privateLinkServiceConnectionName', format('{0}-acr-plsc', parameters('containerRegistryName')), 'privateDnsZoneGroup', if(not(empty(parameters('acrPrivateDnsZoneId'))), createObject('name', 'acr-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'acr-config', 'privateDnsZoneResourceId', parameters('acrPrivateDnsZoneId')))), null())))), createObject('value', createArray()))]"
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.37.4.10188",
+                      "templateHash": "10440624024470892086"
+                    },
+                    "name": "Azure Container Registries (ACR)",
+                    "description": "This module deploys an Azure Container Registry (ACR)."
+                  },
+                  "definitions": {
+                    "privateEndpointOutputType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The name of the private endpoint."
+                          }
+                        },
+                        "resourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "The resource ID of the private endpoint."
+                          }
+                        },
+                        "groupId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "The group Id for the private endpoint Group."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "fqdn": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "FQDN that resolves to private endpoint IP address."
+                                }
+                              },
+                              "ipAddresses": {
+                                "type": "array",
+                                "items": {
+                                  "type": "string"
+                                },
+                                "metadata": {
+                                  "description": "A list of private IP addresses of the private endpoint."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "The custom DNS configurations of the private endpoint."
+                          }
+                        },
+                        "networkInterfaceResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true
+                      }
+                    },
+                    "scopeMapsType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the scope map."
+                          }
+                        },
+                        "actions": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. The list of scoped permissions for registry artifacts."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The user friendly description of the scope map."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a scope map."
+                      }
+                    },
+                    "cacheRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
+                          }
+                        },
+                        "sourceRepository": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Source repository pulled from upstream."
+                          }
+                        },
+                        "targetRepository": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                          }
+                        },
+                        "credentialSetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a cache rule."
+                      }
+                    },
+                    "credentialSetType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the credential set."
+                          }
+                        },
+                        "managedIdentities": {
+                          "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The managed identity definition for this resource."
+                          }
+                        },
+                        "authCredentials": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/authCredentialsType"
+                          },
+                          "metadata": {
+                            "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                          }
+                        },
+                        "loginServer": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The credentials are stored for this upstream or login server."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a credential set."
+                      }
+                    },
+                    "replicationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the replication."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all resources."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags of the resource."
+                          }
+                        },
+                        "regionEndpointEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                          }
+                        },
+                        "zoneRedundancy": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Disabled",
+                            "Enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a replication."
+                      }
+                    },
+                    "webhookType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "minLength": 5,
+                          "maxLength": 50,
+                          "metadata": {
+                            "description": "Optional. The name of the registry webhook."
+                          }
+                        },
+                        "serviceUri": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service URI for the webhook to post notifications."
+                          }
+                        },
+                        "status": {
+                          "type": "string",
+                          "allowedValues": [
+                            "disabled",
+                            "enabled"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The status of the webhook at the time the operation was called."
+                          }
+                        },
+                        "action": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Location for all resources."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Tags of the resource."
+                          }
+                        },
+                        "customHeaders": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom headers that will be added to the webhook notifications."
+                          }
+                        },
+                        "scope": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a webhook."
+                      }
+                    },
+                    "_1.lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointCustomDnsConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "fqdn": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                          }
+                        },
+                        "ipAddresses": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "metadata": {
+                            "description": "Required. A list of private IP addresses of the private endpoint."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointIpConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the resource that is unique within a resource group."
+                          }
+                        },
+                        "properties": {
+                          "type": "object",
+                          "properties": {
+                            "groupId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "memberName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                              }
+                            },
+                            "privateIPAddress": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of private endpoint IP configurations."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private DNS Zone Group."
+                          }
+                        },
+                        "privateDnsZoneGroupConfigs": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "name": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                }
+                              },
+                              "privateDnsZoneResourceId": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. The resource id of the private DNS zone."
+                                }
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "_1.roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "authCredentialsType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the credential."
+                          }
+                        },
+                        "usernameSecretIdentifier": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. KeyVault Secret URI for accessing the username."
+                          }
+                        },
+                        "passwordSecretIdentifier": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. KeyVault Secret URI for accessing the password."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for auth credentials.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "credential-set/main.bicep"
+                        }
+                      }
+                    },
+                    "customerManagedKeyWithAutoRotateType": {
+                      "type": "object",
+                      "properties": {
+                        "keyVaultResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                          }
+                        },
+                        "keyName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the customer managed key to use for encryption."
+                          }
+                        },
+                        "keyVersion": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                          }
+                        },
+                        "autoRotationEnabled": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                          }
+                        },
+                        "userAssignedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "diagnosticSettingFullType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the diagnostic setting."
+                          }
+                        },
+                        "logCategoriesAndGroups": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                }
+                              },
+                              "categoryGroup": {
+                                "type": "string",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "managedIdentityOnlySysAssignedType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "privateEndpointSingleServiceType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the Private Endpoint."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location to deploy the Private Endpoint to."
+                          }
+                        },
+                        "privateLinkServiceConnectionName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the private link connection to create."
+                          }
+                        },
+                        "service": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                          }
+                        },
+                        "subnetResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                          }
+                        },
+                        "resourceGroupResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                          }
+                        },
+                        "privateDnsZoneGroup": {
+                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                          }
+                        },
+                        "isManualConnection": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. If Manual Private Link Connection is required."
+                          }
+                        },
+                        "manualConnectionRequestMessage": {
+                          "type": "string",
+                          "nullable": true,
+                          "maxLength": 140,
+                          "metadata": {
+                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                          }
+                        },
+                        "customDnsConfigs": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Custom DNS configurations."
+                          }
+                        },
+                        "ipConfigurations": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                          }
+                        },
+                        "applicationSecurityGroupResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                          }
+                        },
+                        "customNetworkInterfaceName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                          }
+                        },
+                        "lock": {
+                          "$ref": "#/definitions/_1.lockType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/_1.roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Array of role assignments to create."
+                          }
+                        },
+                        "tags": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                            },
+                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                          }
+                        },
+                        "enableTelemetry": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enable/Disable usage telemetry for module."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "minLength": 5,
+                      "maxLength": 50,
+                      "metadata": {
+                        "description": "Required. Name of your Azure Container Registry."
+                      }
+                    },
+                    "acrAdminUserEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enable admin user that have push / pull permission to the registry."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all resources."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "acrSku": {
+                      "type": "string",
+                      "defaultValue": "Premium",
+                      "allowedValues": [
+                        "Basic",
+                        "Premium",
+                        "Standard"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Tier of your Azure container registry."
+                      }
+                    },
+                    "exportPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the export policy is enabled or not."
+                      }
+                    },
+                    "quarantinePolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "trustPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "retentionPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the retention policy is enabled or not."
+                      }
+                    },
+                    "retentionPolicyDays": {
+                      "type": "int",
+                      "defaultValue": 15,
+                      "metadata": {
+                        "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
+                      }
+                    },
+                    "azureADAuthenticationAsArmPolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "enabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registry is enabled or not. Default is enabled."
+                      }
+                    },
+                    "softDeletePolicyStatus": {
+                      "type": "string",
+                      "defaultValue": "disabled",
+                      "allowedValues": [
+                        "disabled",
+                        "enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Soft Delete policy status. Default is disabled."
+                      }
+                    },
+                    "softDeletePolicyDays": {
+                      "type": "int",
+                      "defaultValue": 7,
+                      "metadata": {
+                        "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
+                      }
+                    },
+                    "dataEndpointEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "nullable": true,
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "networkRuleBypassOptions": {
+                      "type": "string",
+                      "defaultValue": "AzureServices",
+                      "allowedValues": [
+                        "AzureServices",
+                        "None"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
+                      }
+                    },
+                    "networkRuleSetDefaultAction": {
+                      "type": "string",
+                      "defaultValue": "Deny",
+                      "allowedValues": [
+                        "Allow",
+                        "Deny"
+                      ],
+                      "metadata": {
+                        "description": "Optional. The default action of allow or deny when no other rules match."
+                      }
+                    },
+                    "networkRuleSetIpRules": {
+                      "type": "array",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
+                      }
+                    },
+                    "zoneRedundancy": {
+                      "type": "string",
+                      "defaultValue": "Enabled",
+                      "allowedValues": [
+                        "Disabled",
+                        "Enabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                      }
+                    },
+                    "replications": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/replicationType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. All replications to create."
+                      }
+                    },
+                    "webhooks": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/webhookType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. All webhooks to create."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.ContainerRegistry/registries@2025-04-01#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingFullType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    },
+                    "anonymousPullEnabled": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
+                      }
+                    },
+                    "customerManagedKey": {
+                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The customer managed key definition."
+                      }
+                    },
+                    "cacheRules": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/cacheRuleType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of Cache Rules."
+                      }
+                    },
+                    "credentialSets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/credentialSetType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of Credential Sets."
+                      }
+                    },
+                    "scopeMaps": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/scopeMapsType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Scope maps setting."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "enableReferencedModulesTelemetry": false,
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
+                      "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
+                      "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
+                      "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
+                      "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
+                      "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "cMKKeyVault::cMKKey": {
+                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults/keys",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.9.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "cMKKeyVault": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.KeyVault/vaults",
+                      "apiVersion": "2024-11-01",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                    },
+                    "cMKUserAssignedIdentity": {
+                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                      "existing": true,
+                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                      "apiVersion": "2024-11-30",
+                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                    },
+                    "registry": {
+                      "type": "Microsoft.ContainerRegistry/registries",
+                      "apiVersion": "2023-06-01-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "tags": "[parameters('tags')]",
+                      "sku": {
+                        "name": "[parameters('acrSku')]"
+                      },
+                      "properties": {
+                        "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
+                        "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
+                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)))), null())]",
+                        "policies": {
+                          "azureADAuthenticationAsArmPolicy": {
+                            "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
+                          },
+                          "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
+                          "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
+                          "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
+                          "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
+                          "softDeletePolicy": {
+                            "retentionDays": "[parameters('softDeletePolicyDays')]",
+                            "status": "[parameters('softDeletePolicyStatus')]"
+                          }
+                        },
+                        "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
+                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
+                        "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
+                        "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]",
+                        "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
+                      },
+                      "dependsOn": [
+                        "cMKKeyVault::cMKKey",
+                        "cMKUserAssignedIdentity"
+                      ]
+                    },
+                    "registry_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_diagnosticSettings": {
+                      "copy": {
+                        "name": "registry_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          },
+                          {
+                            "name": "logs",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                            "input": {
+                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_roleAssignments": {
+                      "copy": {
+                        "name": "registry_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_scopeMaps": {
+                      "copy": {
+                        "name": "registry_scopeMaps",
+                        "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "actions": {
+                            "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]"
+                          },
+                          "description": {
+                            "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "6143951528715126111"
+                            },
+                            "name": "Container Registries scopeMaps",
+                            "description": "This module deploys an Azure Container Registry (ACR) scopeMap."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]",
+                              "metadata": {
+                                "description": "Optional. The name of the scope map."
+                              }
+                            },
+                            "actions": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "Required. The list of scoped permissions for registry artifacts."
+                              }
+                            },
+                            "description": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The user friendly description of the scope map."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "scopeMap": {
+                              "type": "Microsoft.ContainerRegistry/registries/scopeMaps",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "properties": {
+                                "actions": "[parameters('actions')]",
+                                "description": "[parameters('description')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the scope map."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the scope map was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the scope map."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_replications": {
+                      "copy": {
+                        "name": "registry_replications",
+                        "count": "[length(coalesce(parameters('replications'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
+                          },
+                          "regionEndpointEnabled": {
+                            "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
+                          },
+                          "zoneRedundancy": {
+                            "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "9998680016086915512"
+                            },
+                            "name": "Azure Container Registry (ACR) Replications",
+                            "description": "This module deploys an Azure Container Registry (ACR) Replication."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the replication."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "regionEndpointEnabled": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
+                              }
+                            },
+                            "zoneRedundancy": {
+                              "type": "string",
+                              "defaultValue": "Disabled",
+                              "allowedValues": [
+                                "Disabled",
+                                "Enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "replication": {
+                              "type": "Microsoft.ContainerRegistry/registries/replications",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
+                                "zoneRedundancy": "[parameters('zoneRedundancy')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the replication."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the replication."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the resource group the replication was created in."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('replication', '2023-06-01-preview', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_credentialSets": {
+                      "copy": {
+                        "name": "registry_credentialSets",
+                        "count": "[length(coalesce(parameters('credentialSets'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "managedIdentities": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]"
+                          },
+                          "authCredentials": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]"
+                          },
+                          "loginServer": {
+                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "10146775336818580275"
+                            },
+                            "name": "Container Registries Credential Sets",
+                            "description": "This module deploys an ACR Credential Set."
+                          },
+                          "definitions": {
+                            "authCredentialsType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the credential."
+                                  }
+                                },
+                                "usernameSecretIdentifier": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. KeyVault Secret URI for accessing the username."
+                                  }
+                                },
+                                "passwordSecretIdentifier": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. KeyVault Secret URI for accessing the password."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for auth credentials."
+                              }
+                            },
+                            "managedIdentityOnlySysAssignedType": {
+                              "type": "object",
+                              "properties": {
+                                "systemAssigned": {
+                                  "type": "bool",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Enables system assigned managed identity on the resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the credential set."
+                              }
+                            },
+                            "managedIdentities": {
+                              "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The managed identity definition for this resource."
+                              }
+                            },
+                            "authCredentials": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/authCredentialsType"
+                              },
+                              "metadata": {
+                                "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
+                              }
+                            },
+                            "loginServer": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The credentials are stored for this upstream or login server."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]"
+                          },
+                          "resources": {
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "credentialSet": {
+                              "type": "Microsoft.ContainerRegistry/registries/credentialSets",
+                              "apiVersion": "2023-11-01-preview",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "identity": "[variables('identity')]",
+                              "properties": {
+                                "authCredentials": "[parameters('authCredentials')]",
+                                "loginServer": "[parameters('loginServer')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the Credential Set."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Credential Set."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Credential Set."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The principal ID of the system assigned identity."
+                              },
+                              "value": "[tryGet(tryGet(reference('credentialSet', '2023-11-01-preview', 'full'), 'identity'), 'principalId')]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_cacheRules": {
+                      "copy": {
+                        "name": "registry_cacheRules",
+                        "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "sourceRepository": {
+                            "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
+                          },
+                          "name": {
+                            "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name')]"
+                          },
+                          "targetRepository": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
+                          },
+                          "credentialSetResourceId": {
+                            "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "16179895563671172347"
+                            },
+                            "name": "Container Registries Cache",
+                            "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[replace(replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-'), '*', '')]",
+                              "metadata": {
+                                "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
+                              }
+                            },
+                            "sourceRepository": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Source repository pulled from upstream."
+                              }
+                            },
+                            "targetRepository": {
+                              "type": "string",
+                              "defaultValue": "[parameters('sourceRepository')]",
+                              "metadata": {
+                                "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
+                              }
+                            },
+                            "credentialSetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "cacheRule": {
+                              "type": "Microsoft.ContainerRegistry/registries/cacheRules",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "properties": {
+                                "sourceRepository": "[parameters('sourceRepository')]",
+                                "targetRepository": "[parameters('targetRepository')]",
+                                "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The Name of the Cache Rule."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Cache Rule."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the Cache Rule."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry",
+                        "registry_credentialSets"
+                      ]
+                    },
+                    "registry_webhooks": {
+                      "copy": {
+                        "name": "registry_webhooks",
+                        "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
+                          },
+                          "registryName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
+                          },
+                          "action": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action')]"
+                          },
+                          "customHeaders": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
+                          },
+                          "scope": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
+                          },
+                          "status": {
+                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
+                          },
+                          "serviceUri": {
+                            "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "6514847976022081392"
+                            },
+                            "name": "Azure Container Registry (ACR) Webhooks",
+                            "description": "This module deploys an Azure Container Registry (ACR) Webhook."
+                          },
+                          "parameters": {
+                            "registryName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "name": {
+                              "type": "string",
+                              "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
+                              "minLength": 5,
+                              "maxLength": 50,
+                              "metadata": {
+                                "description": "Optional. The name of the registry webhook."
+                              }
+                            },
+                            "serviceUri": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The service URI for the webhook to post notifications."
+                              }
+                            },
+                            "status": {
+                              "type": "string",
+                              "defaultValue": "enabled",
+                              "allowedValues": [
+                                "disabled",
+                                "enabled"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The status of the webhook at the time the operation was called."
+                              }
+                            },
+                            "action": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "defaultValue": [
+                                "chart_delete",
+                                "chart_push",
+                                "delete",
+                                "push",
+                                "quarantine"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The list of actions that trigger the webhook to post notifications."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all resources."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            },
+                            "customHeaders": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom headers that will be added to the webhook notifications."
+                              }
+                            },
+                            "scope": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "registry": {
+                              "existing": true,
+                              "type": "Microsoft.ContainerRegistry/registries",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[parameters('registryName')]"
+                            },
+                            "webhook": {
+                              "type": "Microsoft.ContainerRegistry/registries/webhooks",
+                              "apiVersion": "2023-06-01-preview",
+                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "actions": "[parameters('action')]",
+                                "customHeaders": "[parameters('customHeaders')]",
+                                "scope": "[parameters('scope')]",
+                                "serviceUri": "[parameters('serviceUri')]",
+                                "status": "[parameters('status')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the webhook."
+                              },
+                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the webhook."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the Azure container registry."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "actions": {
+                              "type": "array",
+                              "metadata": {
+                                "description": "The actions of the webhook."
+                              },
+                              "value": "[reference('webhook').actions]"
+                            },
+                            "status": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The status of the webhook."
+                              },
+                              "value": "[reference('webhook').status]"
+                            },
+                            "provistioningState": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The provisioning state of the webhook."
+                              },
+                              "value": "[reference('webhook').provisioningState]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('webhook', '2023-06-01-preview', 'full').location]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry"
+                      ]
+                    },
+                    "registry_privateEndpoints": {
+                      "copy": {
+                        "name": "registry_privateEndpoints",
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                      },
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
+                          },
+                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
+                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                          "subnetResourceId": {
+                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                          },
+                          "location": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                          },
+                          "lock": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                          },
+                          "privateDnsZoneGroup": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                          },
+                          "customDnsConfigs": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                          },
+                          "ipConfigurations": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                          },
+                          "applicationSecurityGroupResourceIds": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                          },
+                          "customNetworkInterfaceName": {
+                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.34.44.8038",
+                              "templateHash": "12389807800450456797"
+                            },
+                            "name": "Private Endpoints",
+                            "description": "This module deploys a Private Endpoint."
+                          },
+                          "definitions": {
+                            "privateDnsZoneGroupType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                  }
+                                },
+                                "privateDnsZoneGroupConfigs": {
+                                  "type": "array",
+                                  "items": {
+                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "ipConfigurationType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "memberName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                      }
+                                    },
+                                    "privateIPAddress": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private endpoint IP configurations."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "privateLinkServiceConnectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The name of the private link service connection."
+                                  }
+                                },
+                                "properties": {
+                                  "type": "object",
+                                  "properties": {
+                                    "groupIds": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "metadata": {
+                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                      }
+                                    },
+                                    "privateLinkServiceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The resource id of private link service."
+                                      }
+                                    },
+                                    "requestMessage": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of private link service connection."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "customDnsConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "fqdn": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                  }
+                                },
+                                "ipAddresses": {
+                                  "type": "array",
+                                  "items": {
+                                    "type": "string"
+                                  },
+                                  "metadata": {
+                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            },
+                            "privateDnsZoneGroupConfigType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the private DNS zone group config."
+                                  }
+                                },
+                                "privateDnsZoneResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource id of the private DNS zone."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the private endpoint resource to create."
+                              }
+                            },
+                            "subnetResourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                              }
+                            },
+                            "applicationSecurityGroupResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                              }
+                            },
+                            "customNetworkInterfaceName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                              }
+                            },
+                            "ipConfigurations": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/ipConfigurationType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                              }
+                            },
+                            "privateDnsZoneGroup": {
+                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Array of role assignments to create."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                              }
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Custom DNS configurations."
+                              }
+                            },
+                            "manualPrivateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "privateLinkServiceConnections": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "formattedRoleAssignments",
+                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                              }
+                            ],
+                            "builtInRoleNames": {
+                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                            }
+                          },
+                          "resources": {
+                            "avmTelemetry": {
+                              "condition": "[parameters('enableTelemetry')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2024-03-01",
+                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                              "properties": {
+                                "mode": "Incremental",
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "resources": [],
+                                  "outputs": {
+                                    "telemetry": {
+                                      "type": "String",
+                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                    }
+                                  }
+                                }
+                              }
+                            },
+                            "privateEndpoint": {
+                              "type": "Microsoft.Network/privateEndpoints",
+                              "apiVersion": "2024-05-01",
+                              "name": "[parameters('name')]",
+                              "location": "[parameters('location')]",
+                              "tags": "[parameters('tags')]",
+                              "properties": {
+                                "copy": [
+                                  {
+                                    "name": "applicationSecurityGroups",
+                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                    "input": {
+                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                    }
+                                  }
+                                ],
+                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                "subnet": {
+                                  "id": "[parameters('subnetResourceId')]"
+                                }
+                              }
+                            },
+                            "privateEndpoint_lock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_roleAssignments": {
+                              "copy": {
+                                "name": "privateEndpoint_roleAssignments",
+                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                              },
+                              "type": "Microsoft.Authorization/roleAssignments",
+                              "apiVersion": "2022-04-01",
+                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                              "properties": {
+                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            },
+                            "privateEndpoint_privateDnsZoneGroup": {
+                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2022-09-01",
+                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                  },
+                                  "privateEndpointName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "privateDnsZoneConfigs": {
+                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.34.44.8038",
+                                      "templateHash": "13997305779829540948"
+                                    },
+                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                  },
+                                  "definitions": {
+                                    "privateDnsZoneGroupConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private DNS zone group config."
+                                          }
+                                        },
+                                        "privateDnsZoneResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource id of the private DNS zone."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "privateEndpointName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                      }
+                                    },
+                                    "privateDnsZoneConfigs": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                      },
+                                      "minLength": 1,
+                                      "maxLength": 5,
+                                      "metadata": {
+                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                      }
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "metadata": {
+                                        "description": "Optional. The name of the private DNS zone group."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "privateDnsZoneConfigsVar",
+                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                        "input": {
+                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                          "properties": {
+                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                          }
+                                        }
+                                      }
+                                    ]
+                                  },
+                                  "resources": {
+                                    "privateEndpoint": {
+                                      "existing": true,
+                                      "type": "Microsoft.Network/privateEndpoints",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[parameters('privateEndpointName')]"
+                                    },
+                                    "privateDnsZoneGroup": {
+                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                      "apiVersion": "2024-05-01",
+                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                      "properties": {
+                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                      }
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                      },
+                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    }
+                                  }
+                                }
+                              },
+                              "dependsOn": [
+                                "privateEndpoint"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the private endpoint was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the private endpoint."
+                              },
+                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the private endpoint."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The location the resource was deployed into."
+                              },
+                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                            },
+                            "customDnsConfigs": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/customDnsConfigType"
+                              },
+                              "metadata": {
+                                "description": "The custom DNS configurations of the private endpoint."
+                              },
+                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                            },
+                            "networkInterfaceResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "metadata": {
+                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                              },
+                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                            },
+                            "groupId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "The group Id for the private endpoint Group."
+                              },
+                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "registry",
+                        "registry_replications"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Name of the Azure container registry."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "loginServer": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The reference to the Azure container registry."
+                      },
+                      "value": "[reference('registry').loginServer]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Azure container registry."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Azure container registry."
+                      },
+                      "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('registry', '2023-06-01-preview', 'full').location]"
+                    },
+                    "credentialSetsSystemAssignedMIPrincipalIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The Principal IDs of the ACR Credential Sets system-assigned identities."
+                      },
+                      "copy": {
+                        "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
+                        "input": "[tryGet(tryGet(reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+                      }
+                    },
+                    "credentialSetsResourceIds": {
+                      "type": "array",
+                      "metadata": {
+                        "description": "The Resource IDs of the ACR Credential Sets."
+                      },
+                      "copy": {
+                        "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
+                        "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs.resourceId.value]"
+                      }
+                    },
+                    "privateEndpoints": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/privateEndpointOutputType"
+                      },
+                      "metadata": {
+                        "description": "The private endpoints of the Azure container registry."
+                      },
+                      "copy": {
+                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                        "input": {
+                          "name": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                          "resourceId": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                          "groupId": "[tryGet(tryGet(reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                          "customDnsConfigs": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                          "networkInterfaceResourceIds": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                        }
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "value": "[reference('containerRegistry').outputs.name.value]"
+            },
+            "loginServer": {
+              "type": "string",
+              "value": "[reference('containerRegistry').outputs.loginServer.value]"
+            },
+            "resourceGroupName": {
+              "type": "string",
+              "value": "[reference('containerRegistry').outputs.resourceGroupName.value]"
+            },
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('containerRegistry').outputs.resourceId.value]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "value": "[tryGet(tryGet(reference('containerRegistry').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+            },
+            "credentialSetsSystemAssignedMIPrincipalIds": {
+              "type": "array",
+              "value": "[reference('containerRegistry').outputs.credentialSetsSystemAssignedMIPrincipalIds.value]"
+            },
+            "credentialSetsResourceIds": {
+              "type": "array",
+              "value": "[reference('containerRegistry').outputs.credentialSetsResourceIds.value]"
+            },
+            "privateEndpoints": {
+              "type": "array",
+              "value": "[reference('containerRegistry').outputs.privateEndpoints.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "userAssignedIdentity"
+      ]
+    },
+    "containerAppsEnvironment": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('cae-la-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "containerAppsEnvironmentName": {
+            "value": "[variables('containerAppsEnvironmentName')]"
+          },
+          "logAnalyticsWorkspaceResourceId": "[if(not(empty(parameters('existingLogAnalyticsWorkspaceId'))), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), if(variables('shouldCreateLogAnalytics'), createObject('value', reference('logAnalytics').outputs.resourceId.value), createObject('value', '')))]",
+          "userAssignedResourceIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.resourceId.value]"
+            ]
+          },
+          "location": {
+            "value": "[parameters('location')]"
+          },
+          "enablePrivateEndpoint": {
+            "value": "[variables('isAILZIntegrated')]"
+          },
+          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').containerAppsSubnetId), createObject('value', null()))]",
+          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "6720674191352473803"
+            }
+          },
+          "parameters": {
+            "containerAppsEnvironmentName": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the Container Apps Environment"
+              }
+            },
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Location for all resources"
+              }
+            },
+            "logAnalyticsWorkspaceResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Log Analytics workspace resource ID used to derive customer ID and shared key"
+              }
+            },
+            "userAssignedResourceIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "User Assigned Identity resource IDs that will be assigned to the Container Apps Environment"
+              }
+            },
+            "enablePrivateEndpoint": {
+              "type": "bool",
+              "defaultValue": false,
+              "metadata": {
+                "description": "Enable private endpoint for AILZ integrated mode"
+              }
+            },
+            "privateEndpointSubnetId": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
+              }
+            },
+            "publicNetworkAccess": {
+              "type": "string",
+              "defaultValue": "Enabled",
+              "allowedValues": [
+                "Enabled",
+                "Disabled"
+              ],
+              "metadata": {
+                "description": "Public network access setting for the Azure Container Registry"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "resources": {
+            "containerAppsEnvironment": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}.containerAppsEnvironment', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('containerAppsEnvironmentName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "zoneRedundant": {
+                    "value": false
+                  },
+                  "appLogsConfiguration": {
+                    "value": {
+                      "destination": "log-analytics",
+                      "logAnalyticsConfiguration": {
+                        "customerId": "[reference(parameters('logAnalyticsWorkspaceResourceId'), '2021-12-01-preview').customerId]",
+                        "sharedKey": "[listKeys(parameters('logAnalyticsWorkspaceResourceId'), '2021-12-01-preview').primarySharedKey]"
+                      }
+                    }
+                  },
+                  "workloadProfiles": {
+                    "value": [
+                      {
+                        "name": "Consumption",
+                        "workloadProfileType": "Consumption"
+                      }
+                    ]
+                  },
+                  "platformReservedCidr": {
+                    "value": "172.17.17.0/24"
+                  },
+                  "platformReservedDnsIP": {
+                    "value": "172.17.17.17"
+                  },
+                  "publicNetworkAccess": {
+                    "value": "[parameters('publicNetworkAccess')]"
+                  },
+                  "internal": {
+                    "value": "[parameters('enablePrivateEndpoint')]"
+                  },
+                  "infrastructureSubnetResourceId": "[if(parameters('enablePrivateEndpoint'), createObject('value', parameters('privateEndpointSubnetId')), createObject('value', null()))]",
+                  "managedIdentities": {
+                    "value": {
+                      "systemAssigned": true,
+                      "userAssignedResourceIds": "[parameters('userAssignedResourceIds')]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.37.4.10188",
+                      "templateHash": "1345160196550942789"
+                    },
+                    "name": "App ManagedEnvironments",
+                    "description": "This module deploys an App Managed Environment (also known as a Container App Environment)."
+                  },
+                  "definitions": {
+                    "certificateType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the certificate."
+                          }
+                        },
+                        "certificateType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ImagePullTrustedCA",
+                            "ServerSSLCertificate"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The type of the certificate."
+                          }
+                        },
+                        "certificateValue": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The value of the certificate. PFX or PEM blob."
+                          }
+                        },
+                        "certificatePassword": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The password of the certificate."
+                          }
+                        },
+                        "certificateKeyVaultProperties": {
+                          "$ref": "#/definitions/certificateKeyVaultPropertiesType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A key vault reference."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a certificate."
+                      }
+                    },
+                    "storageType": {
+                      "type": "object",
+                      "properties": {
+                        "accessMode": {
+                          "type": "string",
+                          "allowedValues": [
+                            "ReadOnly",
+                            "ReadWrite"
+                          ],
+                          "metadata": {
+                            "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "NFS",
+                            "SMB"
+                          ],
+                          "metadata": {
+                            "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
+                          }
+                        },
+                        "storageAccountName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Storage account name."
+                          }
+                        },
+                        "shareName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. File share name."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type of the storage."
+                      }
+                    },
+                    "appLogsConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "destination": {
+                          "type": "string",
+                          "allowedValues": [
+                            "azure-monitor",
+                            "log-analytics",
+                            "none"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The destination of the logs."
+                          }
+                        },
+                        "logAnalyticsConfiguration": {
+                          "type": "object",
+                          "properties": {
+                            "customerId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The Log Analytics Workspace ID."
+                              }
+                            },
+                            "sharedKey": {
+                              "type": "securestring",
+                              "metadata": {
+                                "description": "Required. The shared key of the Log Analytics workspace."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The Log Analytics configuration. Required if `destination` is `log-analytics`."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the App Logs Configuration."
+                      }
+                    },
+                    "certificateKeyVaultPropertiesType": {
+                      "type": "object",
+                      "properties": {
+                        "identityResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
+                          }
+                        },
+                        "keyVaultUrl": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for the certificate's key vault properties.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "certificates/main.bicep"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container Apps Managed Environment."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/managedEnvironments@2024-10-02-preview#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "appInsightsConnectionString": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Application Insights connection string."
+                      }
+                    },
+                    "daprAIConnectionString": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
+                      }
+                    },
+                    "daprAIInstrumentationKey": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
+                      }
+                    },
+                    "dockerBridgeCidr": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "infrastructureSubnetResourceId": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "internal": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "platformReservedCidr": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
+                      }
+                    },
+                    "platformReservedDnsIP": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "peerTrafficEncryption": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether or not to encrypt peer traffic."
+                      }
+                    },
+                    "publicNetworkAccess": {
+                      "type": "string",
+                      "defaultValue": "Disabled",
+                      "allowedValues": [
+                        "Enabled",
+                        "Disabled"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Whether to allow or block all public traffic."
+                      }
+                    },
+                    "zoneRedundant": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Whether or not this Managed Environment is zone-redundant."
+                      }
+                    },
+                    "certificatePassword": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Password of the certificate used by the custom domain."
+                      }
+                    },
+                    "certificateValue": {
+                      "type": "securestring",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
+                      }
+                    },
+                    "dnsSuffix": {
+                      "type": "string",
+                      "defaultValue": "",
+                      "metadata": {
+                        "description": "Optional. DNS suffix for the environment domain."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "openTelemetryConfiguration": {
+                      "type": "object",
+                      "defaultValue": {},
+                      "metadata": {
+                        "description": "Optional. Open Telemetry configuration."
+                      }
+                    },
+                    "workloadProfiles": {
+                      "type": "array",
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "infrastructureResourceGroupName": {
+                      "type": "string",
+                      "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
+                      "metadata": {
+                        "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
+                      }
+                    },
+                    "storages": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/storageType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The list of storages to mount on the environment."
+                      }
+                    },
+                    "certificate": {
+                      "$ref": "#/definitions/certificateType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. A Managed Environment Certificate."
+                      }
+                    },
+                    "appLogsConfiguration": {
+                      "$ref": "#/definitions/appLogsConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The AppLogsConfiguration for the Managed Environment."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "managedEnvironment::storage": {
+                      "copy": {
+                        "name": "managedEnvironment::storage",
+                        "count": "[length(coalesce(parameters('storages'), createArray()))]"
+                      },
+                      "type": "Microsoft.App/managedEnvironments/storages",
+                      "apiVersion": "2024-10-02-preview",
+                      "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
+                      "properties": {
+                        "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
+                        "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-11-01",
+                      "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.11.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "managedEnvironment": {
+                      "type": "Microsoft.App/managedEnvironments",
+                      "apiVersion": "2024-10-02-preview",
+                      "name": "[parameters('name')]",
+                      "location": "[parameters('location')]",
+                      "tags": "[parameters('tags')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "appInsightsConfiguration": {
+                          "connectionString": "[parameters('appInsightsConnectionString')]"
+                        },
+                        "appLogsConfiguration": "[parameters('appLogsConfiguration')]",
+                        "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
+                        "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
+                        "customDomainConfiguration": {
+                          "certificatePassword": "[parameters('certificatePassword')]",
+                          "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
+                          "dnsSuffix": "[parameters('dnsSuffix')]",
+                          "certificateKeyVaultProperties": "[if(not(empty(tryGet(parameters('certificate'), 'certificateKeyVaultProperties'))), createObject('identity', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'identityResourceId'), 'keyVaultUrl', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'keyVaultUrl')), null())]"
+                        },
+                        "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
+                        "peerTrafficConfiguration": {
+                          "encryption": {
+                            "enabled": "[parameters('peerTrafficEncryption')]"
+                          }
+                        },
+                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
+                        "vnetConfiguration": {
+                          "internal": "[parameters('internal')]",
+                          "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('infrastructureSubnetResourceId'), null())]",
+                          "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('dockerBridgeCidr'), null())]",
+                          "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedCidr'), null())]",
+                          "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedDnsIP'), null())]"
+                        },
+                        "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
+                        "zoneRedundant": "[parameters('zoneRedundant')]",
+                        "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
+                      }
+                    },
+                    "managedEnvironment_roleAssignments": {
+                      "copy": {
+                        "name": "managedEnvironment_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "managedEnvironment_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    },
+                    "managedEnvironment_certificate": {
+                      "condition": "[not(empty(parameters('certificate')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2022-09-01",
+                      "name": "[format('{0}-Managed-Environment-Certificate', uniqueString(deployment().name))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', parameters('name')))]"
+                          },
+                          "managedEnvironmentName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "certificateKeyVaultProperties": {
+                            "value": "[tryGet(parameters('certificate'), 'certificateKeyVaultProperties')]"
+                          },
+                          "certificateType": {
+                            "value": "[tryGet(parameters('certificate'), 'certificateType')]"
+                          },
+                          "certificateValue": {
+                            "value": "[tryGet(parameters('certificate'), 'certificateValue')]"
+                          },
+                          "certificatePassword": {
+                            "value": "[tryGet(parameters('certificate'), 'certificatePassword')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.37.4.10188",
+                              "templateHash": "13507794255589178049"
+                            },
+                            "name": "App ManagedEnvironments Certificates",
+                            "description": "This module deploys a App Managed Environment Certificate."
+                          },
+                          "definitions": {
+                            "certificateKeyVaultPropertiesType": {
+                              "type": "object",
+                              "properties": {
+                                "identityResourceId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
+                                  }
+                                },
+                                "keyVaultUrl": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "The type for the certificate's key vault properties."
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the Container Apps Managed Environment Certificate."
+                              }
+                            },
+                            "managedEnvironmentName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent app managed environment. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Location for all Resources."
+                              }
+                            },
+                            "certificateKeyVaultProperties": {
+                              "$ref": "#/definitions/certificateKeyVaultPropertiesType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. A key vault reference to the certificate to use for the custom domain."
+                              }
+                            },
+                            "certificateType": {
+                              "type": "string",
+                              "nullable": true,
+                              "allowedValues": [
+                                "ServerSSLCertificate",
+                                "ImagePullTrustedCA"
+                              ],
+                              "metadata": {
+                                "description": "Optional. The type of the certificate."
+                              }
+                            },
+                            "certificateValue": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The value of the certificate. PFX or PEM blob."
+                              }
+                            },
+                            "certificatePassword": {
+                              "type": "securestring",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The password of the certificate."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Tags of the resource."
+                              }
+                            }
+                          },
+                          "resources": {
+                            "managedEnvironment": {
+                              "existing": true,
+                              "type": "Microsoft.App/managedEnvironments",
+                              "apiVersion": "2024-10-02-preview",
+                              "name": "[parameters('managedEnvironmentName')]"
+                            },
+                            "managedEnvironmentCertificate": {
+                              "type": "Microsoft.App/managedEnvironments/certificates",
+                              "apiVersion": "2024-10-02-preview",
+                              "name": "[format('{0}/{1}', parameters('managedEnvironmentName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "properties": {
+                                "certificateKeyVaultProperties": "[if(not(empty(parameters('certificateKeyVaultProperties'))), createObject('identity', parameters('certificateKeyVaultProperties').identityResourceId, 'keyVaultUrl', parameters('certificateKeyVaultProperties').keyVaultUrl), null())]",
+                                "certificateType": "[parameters('certificateType')]",
+                                "password": "[parameters('certificatePassword')]",
+                                "value": "[parameters('certificateValue')]"
+                              },
+                              "tags": "[parameters('tags')]"
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the key values."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the key values."
+                              },
+                              "value": "[resourceId('Microsoft.App/managedEnvironments/certificates', parameters('managedEnvironmentName'), parameters('name'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group the batch account was deployed into."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "managedEnvironment"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Managed Environment was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('managedEnvironment', '2024-10-02-preview', 'full').location]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Managed Environment."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Managed Environment."
+                      },
+                      "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('managedEnvironment', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "defaultDomain": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The Default domain of the Managed Environment."
+                      },
+                      "value": "[reference('managedEnvironment').defaultDomain]"
+                    },
+                    "staticIp": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The IP address of the Managed Environment."
+                      },
+                      "value": "[reference('managedEnvironment').staticIp]"
+                    },
+                    "domainVerificationId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The domain verification id for custom domains."
+                      },
+                      "value": "[reference('managedEnvironment').customDomainConfiguration.customDomainVerificationId]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "name": {
+              "type": "string",
+              "value": "[reference('containerAppsEnvironment').outputs.name.value]"
+            },
+            "resourceId": {
+              "type": "string",
+              "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
+            },
+            "location": {
+              "type": "string",
+              "value": "[reference('containerAppsEnvironment').outputs.location.value]"
+            },
+            "systemAssignedMIPrincipalId": {
+              "type": "string",
+              "nullable": true,
+              "value": "[tryGet(tryGet(reference('containerAppsEnvironment').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
+            },
+            "defaultDomain": {
+              "type": "string",
+              "value": "[reference('containerAppsEnvironment').outputs.defaultDomain.value]"
+            },
+            "staticIp": {
+              "type": "string",
+              "value": "[reference('containerAppsEnvironment').outputs.staticIp.value]"
+            },
+            "domainVerificationId": {
+              "type": "string",
+              "value": "[reference('containerAppsEnvironment').outputs.domainVerificationId.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "logAnalytics",
+        "userAssignedIdentity"
+      ]
+    },
+    "aiFoundry": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('aiFoundry-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "aiFoundryBaseName": {
+            "value": "[substring(format('aif{0}', variables('resourceToken')), 0, 12)]"
+          },
+          "roleAssignedManagedIdentityPrincipalIds": {
+            "value": [
+              "[reference('userAssignedIdentity').outputs.principalId.value]"
+            ]
+          },
+          "location": {
+            "value": "[parameters('foundryLocation')]"
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "6680056687043492516"
+            }
+          },
+          "parameters": {
+            "location": {
+              "type": "string",
+              "defaultValue": "[resourceGroup().location]",
+              "metadata": {
+                "description": "Optional: Location for all resources. Default is the resource group location"
+              }
+            },
+            "aiFoundryBaseName": {
+              "type": "string",
+              "metadata": {
+                "description": "Required: The AI Foundry base name (max 12 characters)"
+              }
+            },
+            "roleAssignedManagedIdentityPrincipalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "defaultValue": [],
+              "metadata": {
+                "description": "Managed Identity that will be given access to the AI Foundry Resource"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "variables": {
+            "uniqueRoleAssignmentManagedIdentities": "[union(parameters('roleAssignedManagedIdentityPrincipalIds'), parameters('roleAssignedManagedIdentityPrincipalIds'))]"
+          },
+          "resources": {
+            "aiFoundry": {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('aiFoundry-{0}', uniqueString('aiFoundry', deployment().name))]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "baseName": {
+                    "value": "[parameters('aiFoundryBaseName')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "aiFoundryConfiguration": {
+                    "value": {
+                      "copy": [
+                        {
+                          "name": "roleAssignments",
+                          "count": "[length(variables('uniqueRoleAssignmentManagedIdentities'))]",
+                          "input": {
+                            "principalId": "[variables('uniqueRoleAssignmentManagedIdentities')[copyIndex('roleAssignments')]]",
+                            "principalType": "ServicePrincipal",
+                            "roleDefinitionIdOrName": "53ca6127-db72-4b80-b1b0-d745d6d5456d"
+                          }
+                        }
+                      ],
+                      "allowProjectManagement": true,
+                      "createCapabilityHosts": false,
+                      "disableLocalAuth": true,
+                      "location": "[parameters('location')]",
+                      "project": {
+                        "desc": "AI Foundry project for ContentFlow Solution Accelerator",
+                        "displayName": "ContentFlow",
+                        "name": "contentflow-project"
+                      },
+                      "sku": "S0"
+                    }
+                  },
+                  "aiModelDeployments": {
+                    "value": [
+                      {
+                        "model": {
+                          "format": "OpenAI",
+                          "name": "gpt-4.1-mini",
+                          "version": "2025-04-14"
+                        },
+                        "name": "gpt-4.1-mini",
+                        "sku": {
+                          "capacity": 100,
+                          "name": "GlobalStandard"
+                        }
+                      },
+                      {
+                        "model": {
+                          "format": "OpenAI",
+                          "name": "gpt-4.1",
+                          "version": "2025-04-14"
+                        },
+                        "name": "gpt-4.1",
+                        "sku": {
+                          "capacity": 100,
+                          "name": "GlobalStandard"
+                        }
+                      },
+                      {
+                        "model": {
+                          "format": "OpenAI",
+                          "name": "text-embedding-3-large",
+                          "version": "1"
+                        },
+                        "name": "text-embedding-3-large",
+                        "sku": {
+                          "capacity": 100,
+                          "name": "Standard"
+                        }
+                      }
+                    ]
+                  },
+                  "includeAssociatedResources": {
+                    "value": false
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.38.33.27573",
+                      "templateHash": "16692041582792913299"
+                    },
+                    "name": "ai-foundry",
+                    "description": "Creates an AI Foundry account and project with Standard Agent Services."
+                  },
+                  "definitions": {
+                    "resourceConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "existingResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of an existing resource to use instead of creating a new one. If provided, other parameters are ignored."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name to be used when creating the resource. This is ignored if an existingResourceId is provided."
+                          }
+                        },
+                        "privateDnsZoneResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource ID of the Private DNS Zone that associates with the resource. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Custom configuration for a resource, including optional name, existing resource ID, and role assignments."
+                      }
+                    },
+                    "storageAccountConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "existingResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource Id of an existing Storage Account to use instead of creating a new one. If provided, other parameters are ignored."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name to be used when creating the Storage Account. This is ignored if an existingResourceId is provided."
+                          }
+                        },
+                        "blobPrivateDnsZoneResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource ID of the DNS zone \"blob\" for the Azure Storage Account. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Custom configuration for a Storage Account, including optional name, existing resource ID, containers, and role assignments."
+                      }
+                    },
+                    "foundryConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "accountName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the AI Foundry account."
+                          }
+                        },
+                        "location": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The location of the AI Foundry account. Will default to the resource group location if not specified."
+                          }
+                        },
+                        "sku": {
+                          "type": "string",
+                          "allowedValues": [
+                            "C2",
+                            "C3",
+                            "C4",
+                            "DC0",
+                            "F0",
+                            "F1",
+                            "S",
+                            "S0",
+                            "S1",
+                            "S10",
+                            "S2",
+                            "S3",
+                            "S4",
+                            "S5",
+                            "S6",
+                            "S7",
+                            "S8",
+                            "S9"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region. Defaults to 'S0'."
+                          }
+                        },
+                        "createCapabilityHosts": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether to create Capability Hosts for the AI Agent Service. If true, the AI Foundry Account and default Project will be created with the capability host for the associated resources. Can only be true if 'includeAssociatedResources' is true. Defaults to false."
+                          }
+                        },
+                        "disableLocalAuth": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons. Defaults to true."
+                          }
+                        },
+                        "allowProjectManagement": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Whether to allow project management in the AI Foundry account. If true, users can create and manage projects within the AI Foundry account. Defaults to true."
+                          }
+                        },
+                        "networking": {
+                          "$ref": "#/definitions/foundryNetworkConfigurationType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Values to establish private networking for the AI Foundry account and project."
+                          }
+                        },
+                        "project": {
+                          "$ref": "#/definitions/foundryProjectConfigurationType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. AI Foundry default project."
+                          }
+                        },
+                        "roleAssignments": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/roleAssignmentType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Role assignments to apply to the AI Foundry resource when creating it."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Custom configuration for a AI Foundry, including optional account name and project configuration."
+                      }
+                    },
+                    "foundryNetworkConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "agentServiceSubnetResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource ID of the subnet for the Azure AI Services account. This is required if 'createAIAgentService' is true."
+                          }
+                        },
+                        "cognitiveServicesPrivateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account."
+                          }
+                        },
+                        "openAiPrivateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The Resource ID of the Private DNS Zone for the OpenAI account."
+                          }
+                        },
+                        "aiServicesPrivateDnsZoneResourceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Values to establish private networking for the AI Foundry service."
+                      }
+                    },
+                    "foundryProjectConfigurationType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the AI Foundry project."
+                          }
+                        },
+                        "displayName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The friendly/display name of the AI Foundry project."
+                          }
+                        },
+                        "desc": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the AI Foundry project."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "Custom configuration for an AI Foundry project, including optional name, friendly name, and description."
+                      }
+                    },
+                    "deploymentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of cognitive service account deployment."
+                          }
+                        },
+                        "model": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of Cognitive Services account deployment model."
+                              }
+                            },
+                            "format": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The format of Cognitive Services account deployment model."
+                              }
+                            },
+                            "version": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The version of Cognitive Services account deployment model."
+                              }
+                            }
+                          },
+                          "metadata": {
+                            "description": "Required. Properties of Cognitive Services account deployment model."
+                          }
+                        },
+                        "sku": {
+                          "type": "object",
+                          "properties": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the resource model definition representing SKU."
+                              }
+                            },
+                            "capacity": {
+                              "type": "int",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The capacity of the resource model definition representing SKU."
+                              }
+                            },
+                            "tier": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The tier of the resource model definition representing SKU."
+                              }
+                            },
+                            "size": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The size of the resource model definition representing SKU."
+                              }
+                            },
+                            "family": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The family of the resource model definition representing SKU."
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource model definition representing SKU."
+                          }
+                        },
+                        "raiPolicyName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of RAI policy."
+                          }
+                        },
+                        "versionUpgradeOption": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The version upgrade option."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a cognitive services account deployment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "baseName": {
+                      "type": "string",
+                      "minLength": 3,
+                      "maxLength": 12,
+                      "metadata": {
+                        "description": "Required. A friendly application/environment name to serve as the \"base\" when using the default naming for all resources in this deployment."
+                      }
+                    },
+                    "baseUniqueName": {
+                      "type": "string",
+                      "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('baseName')), 0, 5)]",
+                      "maxLength": 5,
+                      "metadata": {
+                        "description": "Optional. A unique text value for the application/environment. This is used to ensure resource names are unique for global resources. Defaults to a 5-character substring of the unique string generated from the subscription ID, resource group name, and base name."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources. Defaults to the location of the resource group."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "aiModelDeployments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/deploymentType"
+                      },
+                      "defaultValue": [],
+                      "metadata": {
+                        "description": "Optional. Specifies the OpenAI deployments to create."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                        },
+                        "description": "Optional. Specifies the resource tags for all the resources."
+                      },
+                      "defaultValue": {}
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the AI resources."
+                      }
+                    },
+                    "includeAssociatedResources": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Whether to include associated resources: Key Vault, AI Search, Storage Account, and Cosmos DB. If true, these resources will be created. Optionally, existing resources of these types can be supplied in their respective parameters. Defaults to false."
+                      }
+                    },
+                    "privateEndpointSubnetResourceId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The Resource ID of the subnet to establish Private Endpoint(s). If provided, private endpoints will be created for the AI Foundry account and associated resources when creating those resource. Each resource will also require supplied private DNS zone resource ID(s) to establish those private endpoints."
+                      }
+                    },
+                    "aiFoundryConfiguration": {
+                      "$ref": "#/definitions/foundryConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom configuration for the AI Foundry."
+                      }
+                    },
+                    "keyVaultConfiguration": {
+                      "$ref": "#/definitions/resourceConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom configuration for the Key Vault."
+                      }
+                    },
+                    "aiSearchConfiguration": {
+                      "$ref": "#/definitions/resourceConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom configuration for the AI Search resource."
+                      }
+                    },
+                    "storageAccountConfiguration": {
+                      "$ref": "#/definitions/storageAccountConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom configuration for the Storage Account."
+                      }
+                    },
+                    "cosmosDbConfiguration": {
+                      "$ref": "#/definitions/resourceConfigurationType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Custom configuration for the Cosmos DB Account."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "resourcesName": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('baseName'), parameters('baseUniqueName')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]",
+                    "projectName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'name'))), parameters('aiFoundryConfiguration').project.name, format('proj-{0}', variables('resourcesName')))]",
+                    "createCapabilityHosts": "[and(coalesce(tryGet(parameters('aiFoundryConfiguration'), 'createCapabilityHosts'), false()), parameters('includeAssociatedResources'))]"
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.ptn.aiml-aifoundry.{0}.{1}', replace('0.5.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "foundryAccount": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('module.account.{0}', variables('resourcesName')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'accountName'))), createObject('value', parameters('aiFoundryConfiguration').accountName), createObject('value', format('ai{0}', variables('resourcesName'))))]",
+                          "location": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'location'))), createObject('value', parameters('aiFoundryConfiguration').location), createObject('value', parameters('location')))]",
+                          "sku": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'sku'))), createObject('value', parameters('aiFoundryConfiguration').sku), createObject('value', 'S0'))]",
+                          "disableLocalAuth": {
+                            "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'disableLocalAuth'), true())]"
+                          },
+                          "allowProjectManagement": {
+                            "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'allowProjectManagement'), true())]"
+                          },
+                          "aiModelDeployments": {
+                            "value": "[parameters('aiModelDeployments')]"
+                          },
+                          "privateEndpointSubnetResourceId": {
+                            "value": "[parameters('privateEndpointSubnetResourceId')]"
+                          },
+                          "agentSubnetResourceId": {
+                            "value": "[tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')]"
+                          },
+                          "privateDnsZoneResourceIds": "[if(and(not(empty(parameters('privateEndpointSubnetResourceId'))), not(empty(tryGet(parameters('aiFoundryConfiguration'), 'networking')))), createObject('value', createArray(parameters('aiFoundryConfiguration').networking.cognitiveServicesPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.openAiPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.aiServicesPrivateDnsZoneResourceId)), createObject('value', createArray()))]",
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('aiFoundryConfiguration'), 'roleAssignments')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "11906964530752207086"
+                            }
+                          },
+                          "definitions": {
+                            "deploymentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of cognitive service account deployment."
+                                  }
+                                },
+                                "model": {
+                                  "type": "object",
+                                  "properties": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of Cognitive Services account deployment model."
+                                      }
+                                    },
+                                    "format": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The format of Cognitive Services account deployment model."
+                                      }
+                                    },
+                                    "version": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The version of Cognitive Services account deployment model."
+                                      }
+                                    }
+                                  },
+                                  "metadata": {
+                                    "description": "Required. Properties of Cognitive Services account deployment model."
+                                  }
+                                },
+                                "sku": {
+                                  "type": "object",
+                                  "properties": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "capacity": {
+                                      "type": "int",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The capacity of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "tier": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The tier of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "size": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The size of the resource model definition representing SKU."
+                                      }
+                                    },
+                                    "family": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The family of the resource model definition representing SKU."
+                                      }
+                                    }
+                                  },
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The resource model definition representing SKU."
+                                  }
+                                },
+                                "raiPolicyName": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of RAI policy."
+                                  }
+                                },
+                                "versionUpgradeOption": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The version upgrade option."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "The type for a cognitive services account deployment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0"
+                                }
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            },
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The name of the AI Foundry resource."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The location for the AI Foundry resource."
+                              }
+                            },
+                            "sku": {
+                              "type": "string",
+                              "defaultValue": "S0",
+                              "allowedValues": [
+                                "C2",
+                                "C3",
+                                "C4",
+                                "F0",
+                                "F1",
+                                "S",
+                                "S0",
+                                "S1",
+                                "S10",
+                                "S2",
+                                "S3",
+                                "S4",
+                                "S5",
+                                "S6",
+                                "S7",
+                                "S8",
+                                "S9",
+                                "DC0"
+                              ],
+                              "metadata": {
+                                "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                              }
+                            },
+                            "allowProjectManagement": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Whether to allow project management in AI Foundry. This is required to enable the AI Foundry UI and project management features."
+                              }
+                            },
+                            "privateEndpointSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceIds' to establish private endpoints."
+                              }
+                            },
+                            "agentSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource Id of an existing subnet to use for agent connectivity. This is required when using agents with private endpoints."
+                              }
+                            },
+                            "disableLocalAuth": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Allow only Azure AD authentication. Should be enabled for security reasons."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the role assignments for the AI Foundry resource."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of AI Foundry resources."
+                              }
+                            },
+                            "aiModelDeployments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/deploymentType"
+                              },
+                              "defaultValue": [],
+                              "metadata": {
+                                "description": "Optional. Specifies the OpenAI deployments to create."
+                              }
+                            },
+                            "privateDnsZoneResourceIds": {
+                              "type": "array",
+                              "items": {
+                                "type": "string"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. List of private DNS zone resource IDs to use for the AI Foundry resource. This is required when using private endpoints."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Specifies the resource tags for all the resources."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "copy": [
+                              {
+                                "name": "privateDnsZoneResourceIdValues",
+                                "count": "[length(coalesce(parameters('privateDnsZoneResourceIds'), createArray()))]",
+                                "input": {
+                                  "privateDnsZoneResourceId": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())[copyIndex('privateDnsZoneResourceIdValues')]]"
+                                }
+                              }
+                            ],
+                            "privateNetworkingEnabled": "[and(not(empty(variables('privateDnsZoneResourceIdValues'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
+                          },
+                          "resources": {
+                            "foundryAccount": {
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('avm.res.cognitive-services.account.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "tags": {
+                                    "value": "[parameters('tags')]"
+                                  },
+                                  "sku": {
+                                    "value": "[parameters('sku')]"
+                                  },
+                                  "kind": {
+                                    "value": "AIServices"
+                                  },
+                                  "lock": {
+                                    "value": "[parameters('lock')]"
+                                  },
+                                  "allowProjectManagement": {
+                                    "value": "[parameters('allowProjectManagement')]"
+                                  },
+                                  "managedIdentities": {
+                                    "value": {
+                                      "systemAssigned": true
+                                    }
+                                  },
+                                  "deployments": {
+                                    "value": "[parameters('aiModelDeployments')]"
+                                  },
+                                  "customSubDomainName": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "disableLocalAuth": {
+                                    "value": "[parameters('disableLocalAuth')]"
+                                  },
+                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                                  "networkAcls": {
+                                    "value": {
+                                      "defaultAction": "Allow",
+                                      "bypass": "AzureServices"
+                                    }
+                                  },
+                                  "networkInjections": "[if(and(variables('privateNetworkingEnabled'), not(empty(parameters('agentSubnetResourceId')))), createObject('value', createObject('scenario', 'agent', 'subnetResourceId', parameters('agentSubnetResourceId'), 'useMicrosoftManagedNetwork', false())), createObject('value', null()))]",
+                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', variables('privateDnsZoneResourceIdValues')), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
+                                  "enableTelemetry": {
+                                    "value": "[parameters('enableTelemetry')]"
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "9381727816193702843"
+                                    },
+                                    "name": "Cognitive Services",
+                                    "description": "This module deploys a Cognitive Service."
+                                  },
+                                  "definitions": {
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group Id for the private endpoint Group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "FQDN that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses of the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the private endpoint output."
+                                      }
+                                    },
+                                    "deploymentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of cognitive service account deployment."
+                                          }
+                                        },
+                                        "model": {
+                                          "type": "object",
+                                          "properties": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of Cognitive Services account deployment model."
+                                              }
+                                            },
+                                            "format": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The format of Cognitive Services account deployment model."
+                                              }
+                                            },
+                                            "version": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The version of Cognitive Services account deployment model."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of Cognitive Services account deployment model."
+                                          }
+                                        },
+                                        "sku": {
+                                          "type": "object",
+                                          "properties": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the resource model definition representing SKU."
+                                              }
+                                            },
+                                            "capacity": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The capacity of the resource model definition representing SKU."
+                                              }
+                                            },
+                                            "tier": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The tier of the resource model definition representing SKU."
+                                              }
+                                            },
+                                            "size": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The size of the resource model definition representing SKU."
+                                              }
+                                            },
+                                            "family": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The family of the resource model definition representing SKU."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource model definition representing SKU."
+                                          }
+                                        },
+                                        "raiPolicyName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of RAI policy."
+                                          }
+                                        },
+                                        "versionUpgradeOption": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The version upgrade option."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a cognitive services account deployment."
+                                      }
+                                    },
+                                    "endpointType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Type of the endpoint."
+                                          }
+                                        },
+                                        "endpoint": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The endpoint URI."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a cognitive services account endpoint."
+                                      }
+                                    },
+                                    "secretsExportConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                                          }
+                                        },
+                                        "accessKey1Name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name for the accessKey1 secret to create."
+                                          }
+                                        },
+                                        "accessKey2Name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name for the accessKey2 secret to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of the secrets exported to the provided Key Vault."
+                                      }
+                                    },
+                                    "commitmentPlanType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "autoRenew": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Whether the plan should auto-renew at the end of the current commitment period."
+                                          }
+                                        },
+                                        "current": {
+                                          "type": "object",
+                                          "properties": {
+                                            "count": {
+                                              "type": "int",
+                                              "metadata": {
+                                                "description": "Required. The number of committed instances (e.g., number of containers or cores)."
+                                              }
+                                            },
+                                            "tier": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The tier of the commitment plan (e.g., T1, T2)."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The current commitment configuration."
+                                          }
+                                        },
+                                        "hostingModel": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The hosting model for the commitment plan. (e.g., DisconnectedContainer, ConnectedContainer, ProvisionedWeb, Web)."
+                                          }
+                                        },
+                                        "planType": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The plan type indicating which capability the plan applies to (e.g., NTTS, STT, CUSTOMSTT, ADDON)."
+                                          }
+                                        },
+                                        "commitmentPlanGuid": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The unique identifier of an existing commitment plan to update. Set to null to create a new plan."
+                                          }
+                                        },
+                                        "next": {
+                                          "type": "object",
+                                          "properties": {
+                                            "count": {
+                                              "type": "int",
+                                              "metadata": {
+                                                "description": "Required. The number of committed instances for the next period."
+                                              }
+                                            },
+                                            "tier": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The tier for the next commitment period."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The configuration of the next commitment period, if scheduled."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a disconnected container commitment plan."
+                                      }
+                                    },
+                                    "networkInjectionType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "scenario": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "agent",
+                                            "none"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. The scenario for the network injection."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The Resource ID of the subnet on the Virtual Network on which to inject."
+                                          }
+                                        },
+                                        "useMicrosoftManagedNetwork": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Whether to use Microsoft Managed Network. Defaults to false."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
+                                      }
+                                    },
+                                    "_1.secretSetOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        },
+                                        "secretUriWithVersion": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI with version of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "_2.lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_2.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_2.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_2.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_2.roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "customerManagedKeyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                          }
+                                        },
+                                        "keyName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the customer managed key to use for encryption."
+                                          }
+                                        },
+                                        "keyVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
+                                          }
+                                        },
+                                        "userAssignedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointSingleServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private Endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the Private Endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_2.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/_2.lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_2.roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "secretsOutputType": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "$ref": "#/definitions/_1.secretSetOutputType",
+                                        "metadata": {
+                                          "description": "An exported secret's references."
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "A map of the exported secrets",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of Cognitive Services account."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "allowedValues": [
+                                        "AIServices",
+                                        "AnomalyDetector",
+                                        "CognitiveServices",
+                                        "ComputerVision",
+                                        "ContentModerator",
+                                        "ContentSafety",
+                                        "ConversationalLanguageUnderstanding",
+                                        "CustomVision.Prediction",
+                                        "CustomVision.Training",
+                                        "Face",
+                                        "FormRecognizer",
+                                        "HealthInsights",
+                                        "ImmersiveReader",
+                                        "Internal.AllInOne",
+                                        "LUIS",
+                                        "LUIS.Authoring",
+                                        "LanguageAuthoring",
+                                        "MetricsAdvisor",
+                                        "OpenAI",
+                                        "Personalizer",
+                                        "QnAMaker.v2",
+                                        "SpeechServices",
+                                        "TextAnalytics",
+                                        "TextTranslation"
+                                      ],
+                                      "metadata": {
+                                        "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                                      }
+                                    },
+                                    "sku": {
+                                      "type": "string",
+                                      "defaultValue": "S0",
+                                      "allowedValues": [
+                                        "C2",
+                                        "C3",
+                                        "C4",
+                                        "F0",
+                                        "F1",
+                                        "S",
+                                        "S0",
+                                        "S1",
+                                        "S10",
+                                        "S2",
+                                        "S3",
+                                        "S4",
+                                        "S5",
+                                        "S6",
+                                        "S7",
+                                        "S8",
+                                        "S9",
+                                        "DC0"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Enabled",
+                                        "Disabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                                      }
+                                    },
+                                    "customSubDomainName": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
+                                      }
+                                    },
+                                    "networkAcls": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. A collection of rules governing the accessibility from specific network locations."
+                                      }
+                                    },
+                                    "networkInjections": {
+                                      "$ref": "#/definitions/networkInjectionType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Tags of the resource."
+                                      }
+                                    },
+                                    "allowedFqdnList": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. List of allowed FQDN."
+                                      }
+                                    },
+                                    "apiProperties": {
+                                      "type": "object",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The API properties for special APIs."
+                                      }
+                                    },
+                                    "disableLocalAuth": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
+                                      }
+                                    },
+                                    "customerManagedKey": {
+                                      "$ref": "#/definitions/customerManagedKeyType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The customer managed key definition."
+                                      }
+                                    },
+                                    "dynamicThrottlingEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. The flag to enable dynamic throttling."
+                                      }
+                                    },
+                                    "migrationToken": {
+                                      "type": "securestring",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Resource migration token."
+                                      }
+                                    },
+                                    "restore": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists."
+                                      }
+                                    },
+                                    "restrictOutboundNetworkAccess": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Restrict outbound network access."
+                                      }
+                                    },
+                                    "userOwnedStorage": {
+                                      "type": "array",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.CognitiveServices/accounts@2025-04-01-preview#properties/properties/properties/userOwnedStorage"
+                                        },
+                                        "description": "Optional. The storage accounts for this resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "deployments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/deploymentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of deployments about cognitive service accounts to create."
+                                      }
+                                    },
+                                    "secretsExportConfiguration": {
+                                      "$ref": "#/definitions/secretsExportConfigurationType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                                      }
+                                    },
+                                    "allowProjectManagement": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable project management feature for AI Foundry."
+                                      }
+                                    },
+                                    "commitmentPlans": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/commitmentPlanType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Commitment plans to deploy for the cognitive services account."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "builtInRoleNames": {
+                                      "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
+                                      "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
+                                      "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
+                                      "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
+                                      "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
+                                      "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
+                                      "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
+                                      "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
+                                      "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
+                                      "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
+                                      "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
+                                      "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
+                                      "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
+                                      "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
+                                      "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
+                                      "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
+                                      "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
+                                      "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
+                                      "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
+                                      "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
+                                      "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
+                                      "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
+                                      "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
+                                      "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
+                                      "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "cMKKeyVault::cMKKey": {
+                                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults/keys",
+                                      "apiVersion": "2024-11-01",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.13.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "cMKKeyVault": {
+                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2024-11-01",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                                    },
+                                    "cMKUserAssignedIdentity": {
+                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                                      "apiVersion": "2025-01-31-preview",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                                    },
+                                    "cognitiveService": {
+                                      "type": "Microsoft.CognitiveServices/accounts",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[parameters('name')]",
+                                      "kind": "[parameters('kind')]",
+                                      "identity": "[variables('identity')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "sku": {
+                                        "name": "[parameters('sku')]"
+                                      },
+                                      "properties": {
+                                        "allowProjectManagement": "[parameters('allowProjectManagement')]",
+                                        "customSubDomainName": "[parameters('customSubDomainName')]",
+                                        "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                                        "networkInjections": "[if(not(empty(parameters('networkInjections'))), createArray(createObject('scenario', tryGet(parameters('networkInjections'), 'scenario'), 'subnetArmId', tryGet(parameters('networkInjections'), 'subnetResourceId'), 'useMicrosoftManagedNetwork', coalesce(tryGet(parameters('networkInjections'), 'useMicrosoftManagedNetwork'), false()))), null())]",
+                                        "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
+                                        "allowedFqdnList": "[parameters('allowedFqdnList')]",
+                                        "apiProperties": "[parameters('apiProperties')]",
+                                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]",
+                                        "migrationToken": "[parameters('migrationToken')]",
+                                        "restore": "[parameters('restore')]",
+                                        "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
+                                        "userOwnedStorage": "[if(not(empty(parameters('userOwnedStorage'))), parameters('userOwnedStorage'), null())]",
+                                        "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
+                                      },
+                                      "dependsOn": [
+                                        "cMKKeyVault",
+                                        "cMKKeyVault::cMKKey",
+                                        "cMKUserAssignedIdentity"
+                                      ]
+                                    },
+                                    "cognitiveService_deployments": {
+                                      "copy": {
+                                        "name": "cognitiveService_deployments",
+                                        "count": "[length(coalesce(parameters('deployments'), createArray()))]",
+                                        "mode": "serial",
+                                        "batchSize": 1
+                                      },
+                                      "type": "Microsoft.CognitiveServices/accounts/deployments",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
+                                      "properties": {
+                                        "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
+                                        "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
+                                        "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
+                                      },
+                                      "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]",
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    },
+                                    "cognitiveService_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    },
+                                    "cognitiveService_commitmentPlans": {
+                                      "copy": {
+                                        "name": "cognitiveService_commitmentPlans",
+                                        "count": "[length(coalesce(parameters('commitmentPlans'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.CognitiveServices/accounts/commitmentPlans",
+                                      "apiVersion": "2025-06-01",
+                                      "name": "[format('{0}/{1}', parameters('name'), format('{0}-{1}', coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].hostingModel, coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].planType))]",
+                                      "properties": "[coalesce(parameters('commitmentPlans'), createArray())[copyIndex()]]",
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    },
+                                    "cognitiveService_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "cognitiveService_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    },
+                                    "cognitiveService_roleAssignments": {
+                                      "copy": {
+                                        "name": "cognitiveService_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    },
+                                    "cognitiveService_privateEndpoints": {
+                                      "copy": {
+                                        "name": "cognitiveService_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.34.44.8038",
+                                              "templateHash": "12389807800450456797"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "ipConfigurationType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "memberName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "privateIPAddress": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private endpoint IP configurations."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "privateLinkServiceConnectionType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the private link service connection."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupIds": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                                      }
+                                                    },
+                                                    "privateLinkServiceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource id of private link service."
+                                                      }
+                                                    },
+                                                    "requestMessage": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private link service connection."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "customDnsConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                                  }
+                                                },
+                                                "ipAddresses": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/ipConfigurationType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              }
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              }
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS configurations."
+                                              }
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.34.44.8038",
+                                                      "templateHash": "13997305779829540948"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "privateDnsZoneConfigsVar",
+                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                        "input": {
+                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                                          "properties": {
+                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                                          }
+                                                        }
+                                                      }
+                                                    ]
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "metadata": {
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    },
+                                    "secretsExport": {
+                                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "keyVaultName": {
+                                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                          },
+                                          "secretsToSet": {
+                                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-06-01').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-06-01').key2)), createArray()))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "10828079590669389085"
+                                            }
+                                          },
+                                          "definitions": {
+                                            "secretSetOutputType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "secretResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The resourceId of the exported secret."
+                                                  }
+                                                },
+                                                "secretUri": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The secret URI of the exported secret."
+                                                  }
+                                                },
+                                                "secretUriWithVersion": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The secret URI with version of the exported secret."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "secretToSetType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the secret to set."
+                                                  }
+                                                },
+                                                "value": {
+                                                  "type": "securestring",
+                                                  "metadata": {
+                                                    "description": "Required. The value of the secret to set."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "keyVaultName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                                              }
+                                            },
+                                            "secretsToSet": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/secretToSetType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. The secrets to set in the Key Vault."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "keyVault": {
+                                              "existing": true,
+                                              "type": "Microsoft.KeyVault/vaults",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('keyVaultName')]"
+                                            },
+                                            "secrets": {
+                                              "copy": {
+                                                "name": "secrets",
+                                                "count": "[length(parameters('secretsToSet'))]"
+                                              },
+                                              "type": "Microsoft.KeyVault/vaults/secrets",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                              "properties": {
+                                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "secretsSet": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/secretSetOutputType"
+                                              },
+                                              "metadata": {
+                                                "description": "The references to the secrets exported to the provided Key Vault."
+                                              },
+                                              "copy": {
+                                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                                "input": {
+                                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                                }
+                                              }
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "cognitiveService"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the cognitive services account."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the cognitive services account."
+                                      },
+                                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group the cognitive services account was deployed into."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "endpoint": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The service endpoint of the cognitive services account."
+                                      },
+                                      "value": "[reference('cognitiveService').endpoint]"
+                                    },
+                                    "endpoints": {
+                                      "$ref": "#/definitions/endpointType",
+                                      "metadata": {
+                                        "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
+                                      },
+                                      "value": "[reference('cognitiveService').endpoints]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('cognitiveService', '2025-06-01', 'full'), 'identity'), 'principalId')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('cognitiveService', '2025-06-01', 'full').location]"
+                                    },
+                                    "exportedSecrets": {
+                                      "$ref": "#/definitions/secretsOutputType",
+                                      "metadata": {
+                                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                                      },
+                                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the congitive services account."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the AI Foundry resource."
+                              },
+                              "value": "[reference('foundryAccount').outputs.name.value]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the AI Foundry resource."
+                              },
+                              "value": "[reference('foundryAccount').outputs.resourceId.value]"
+                            },
+                            "subscriptionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Subscription ID of the AI Foundry resource."
+                              },
+                              "value": "[subscription().subscriptionId]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource Group Name of the AI Foundry resource."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Location of the AI Foundry resource."
+                              },
+                              "value": "[parameters('location')]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "System assigned managed identity principal ID of the AI Foundry resource."
+                              },
+                              "value": "[reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "keyVault": {
+                      "condition": "[parameters('includeAssociatedResources')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('module.keyVault.{0}', variables('resourcesName')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "existingResourceId": {
+                            "value": "[tryGet(parameters('keyVaultConfiguration'), 'existingResourceId')]"
+                          },
+                          "name": {
+                            "value": "[take(if(and(not(empty(parameters('keyVaultConfiguration'))), not(empty(tryGet(parameters('keyVaultConfiguration'), 'name')))), parameters('keyVaultConfiguration').name, format('kv{0}', variables('resourcesName'))), 24)]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "privateEndpointSubnetResourceId": {
+                            "value": "[parameters('privateEndpointSubnetResourceId')]"
+                          },
+                          "privateDnsZoneResourceId": {
+                            "value": "[tryGet(parameters('keyVaultConfiguration'), 'privateDnsZoneResourceId')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('keyVaultConfiguration'), 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "9899473530932390252"
+                            }
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "functions": [
+                            {
+                              "namespace": "__bicep",
+                              "members": {
+                                "getResourceGroupName": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Group Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceName": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    },
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceParts": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
+                                  },
+                                  "metadata": {
+                                    "description": "Splits Resource ID into its components.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getSubscriptionId": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Subscription ID from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          ],
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Required. The name of the Key Vault."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The location for the Key Vault."
+                              }
+                            },
+                            "existingResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The full resource ID of an existing Key Vault to use instead of creating a new one."
+                              }
+                            },
+                            "privateEndpointSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints."
+                              }
+                            },
+                            "privateDnsZoneResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the private DNS zone for the Key Vault to establish private endpoints."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the role assignments for the Key Vault."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Specifies the resource tags for all the resources."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
+                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
+                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
+                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
+                            "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
+                          },
+                          "resources": {
+                            "existingKeyVault": {
+                              "condition": "[not(empty(parameters('existingResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.KeyVault/vaults",
+                              "apiVersion": "2024-11-01",
+                              "subscriptionId": "[variables('existingSubscriptionId')]",
+                              "resourceGroup": "[variables('existingResourceGroupName')]",
+                              "name": "[variables('existingName')]"
+                            },
+                            "keyVault": {
+                              "condition": "[empty(parameters('existingResourceId'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('avm.res.key-vault.vault.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "tags": {
+                                    "value": "[parameters('tags')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[parameters('enableTelemetry')]"
+                                  },
+                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                                  "networkAcls": {
+                                    "value": {
+                                      "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]"
+                                    }
+                                  },
+                                  "enableVaultForDeployment": {
+                                    "value": true
+                                  },
+                                  "enableVaultForDiskEncryption": {
+                                    "value": true
+                                  },
+                                  "enableVaultForTemplateDeployment": {
+                                    "value": true
+                                  },
+                                  "enablePurgeProtection": {
+                                    "value": false
+                                  },
+                                  "enableRbacAuthorization": {
+                                    "value": true
+                                  },
+                                  "enableSoftDelete": {
+                                    "value": true
+                                  },
+                                  "softDeleteRetentionInDays": {
+                                    "value": 7
+                                  },
+                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'vault', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "8811577289487069918"
+                                    },
+                                    "name": "Key Vaults",
+                                    "description": "This module deploys a Key Vault."
+                                  },
+                                  "definitions": {
+                                    "networkAclsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "bypass": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureServices",
+                                            "None"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The bypass options for traffic for the network ACLs."
+                                          }
+                                        },
+                                        "defaultAction": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Allow",
+                                            "Deny"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The default action for the network ACLs, when no rule matches."
+                                          }
+                                        },
+                                        "ipRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "value": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. An IPv4 address range in CIDR notation, such as \"124.56.78.91\" (simple IP address) or \"124.56.78.0/24\"."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP rules."
+                                          }
+                                        },
+                                        "virtualNetworkRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "id": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource ID of the virtual network subnet."
+                                                }
+                                              },
+                                              "ignoreMissingVnetServiceEndpoint": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Whether NRP will ignore the check if parent subnet has serviceEndpoints configured."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of virtual network rules."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for rules governing the accessibility of the key vault from specific network locations."
+                                      }
+                                    },
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group Id for the private endpoint Group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "FQDN that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses of the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "credentialOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The item's resourceId."
+                                          }
+                                        },
+                                        "uri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The item's uri."
+                                          }
+                                        },
+                                        "uriWithVersion": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The item's uri with version."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a credential output."
+                                      }
+                                    },
+                                    "accessPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "tenantId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                                          }
+                                        },
+                                        "objectId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                                          }
+                                        },
+                                        "applicationId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application ID of the client making request on behalf of a principal."
+                                          }
+                                        },
+                                        "permissions": {
+                                          "type": "object",
+                                          "properties": {
+                                            "keys": {
+                                              "type": "array",
+                                              "allowedValues": [
+                                                "all",
+                                                "backup",
+                                                "create",
+                                                "decrypt",
+                                                "delete",
+                                                "encrypt",
+                                                "get",
+                                                "getrotationpolicy",
+                                                "import",
+                                                "list",
+                                                "purge",
+                                                "recover",
+                                                "release",
+                                                "restore",
+                                                "rotate",
+                                                "setrotationpolicy",
+                                                "sign",
+                                                "unwrapKey",
+                                                "update",
+                                                "verify",
+                                                "wrapKey"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Permissions to keys."
+                                              }
+                                            },
+                                            "secrets": {
+                                              "type": "array",
+                                              "allowedValues": [
+                                                "all",
+                                                "backup",
+                                                "delete",
+                                                "get",
+                                                "list",
+                                                "purge",
+                                                "recover",
+                                                "restore",
+                                                "set"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Permissions to secrets."
+                                              }
+                                            },
+                                            "certificates": {
+                                              "type": "array",
+                                              "allowedValues": [
+                                                "all",
+                                                "backup",
+                                                "create",
+                                                "delete",
+                                                "deleteissuers",
+                                                "get",
+                                                "getissuers",
+                                                "import",
+                                                "list",
+                                                "listissuers",
+                                                "managecontacts",
+                                                "manageissuers",
+                                                "purge",
+                                                "recover",
+                                                "restore",
+                                                "setissuers",
+                                                "update"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Permissions to certificates."
+                                              }
+                                            },
+                                            "storage": {
+                                              "type": "array",
+                                              "allowedValues": [
+                                                "all",
+                                                "backup",
+                                                "delete",
+                                                "deletesas",
+                                                "get",
+                                                "getsas",
+                                                "list",
+                                                "listsas",
+                                                "purge",
+                                                "recover",
+                                                "regeneratekey",
+                                                "restore",
+                                                "set",
+                                                "setsas",
+                                                "update"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Permissions to storage accounts."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for an access policy."
+                                      }
+                                    },
+                                    "secretType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the secret."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource tags."
+                                          }
+                                        },
+                                        "attributes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Defines whether the secret is enabled or disabled."
+                                              }
+                                            },
+                                            "exp": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                              }
+                                            },
+                                            "nbf": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Contains attributes of the secret."
+                                          }
+                                        },
+                                        "contentType": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The content type of the secret."
+                                          }
+                                        },
+                                        "value": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a secret output."
+                                      }
+                                    },
+                                    "keyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the key."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource tags."
+                                          }
+                                        },
+                                        "attributes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "enabled": {
+                                              "type": "bool",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Defines whether the key is enabled or disabled."
+                                              }
+                                            },
+                                            "exp": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                              }
+                                            },
+                                            "nbf": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Contains attributes of the key."
+                                          }
+                                        },
+                                        "curveName": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "P-256",
+                                            "P-256K",
+                                            "P-384",
+                                            "P-521"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"."
+                                          }
+                                        },
+                                        "keyOps": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            "decrypt",
+                                            "encrypt",
+                                            "import",
+                                            "release",
+                                            "sign",
+                                            "unwrapKey",
+                                            "verify",
+                                            "wrapKey"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The allowed operations on this key."
+                                          }
+                                        },
+                                        "keySize": {
+                                          "type": "int",
+                                          "allowedValues": [
+                                            2048,
+                                            3072,
+                                            4096
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"."
+                                          }
+                                        },
+                                        "kty": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "EC",
+                                            "EC-HSM",
+                                            "RSA",
+                                            "RSA-HSM"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The type of the key. Default is \"EC\"."
+                                          }
+                                        },
+                                        "releasePolicy": {
+                                          "type": "object",
+                                          "properties": {
+                                            "contentType": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Content type and version of key release policy."
+                                              }
+                                            },
+                                            "data": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Blob encoding the policy rules under which the key can be released."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key release policy."
+                                          }
+                                        },
+                                        "rotationPolicy": {
+                                          "$ref": "#/definitions/rotationPolicyType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Key rotation policy."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for a key."
+                                      }
+                                    },
+                                    "_1.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointSingleServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private Endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the Private Endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "rotationPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "attributes": {
+                                          "type": "object",
+                                          "properties": {
+                                            "expiryTime": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The attributes of key rotation policy."
+                                          }
+                                        },
+                                        "lifetimeActions": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "action": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "type": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "notify",
+                                                      "rotate"
+                                                    ],
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The type of the action."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The type of the action."
+                                                }
+                                              },
+                                              "trigger": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "timeAfterCreate": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                                                    }
+                                                  },
+                                                  "timeBeforeExpiry": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The time duration for rotating the key."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The key rotation policy lifetime actions."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for a rotation policy.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "key/main.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Required. Name of the Key Vault. Must be globally unique."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "accessPolicies": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/accessPolicyType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. All access policies to create."
+                                      }
+                                    },
+                                    "secrets": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/secretType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. All secrets to create."
+                                      }
+                                    },
+                                    "keys": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/keyType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. All keys to create."
+                                      }
+                                    },
+                                    "enableVaultForDeployment": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies if the vault is enabled for deployment by script or compute."
+                                      }
+                                    },
+                                    "enableVaultForTemplateDeployment": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies if the vault is enabled for a template deployment."
+                                      }
+                                    },
+                                    "enableVaultForDiskEncryption": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios."
+                                      }
+                                    },
+                                    "enableSoftDelete": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Switch to enable/disable Key Vault's soft delete feature."
+                                      }
+                                    },
+                                    "softDeleteRetentionInDays": {
+                                      "type": "int",
+                                      "defaultValue": 90,
+                                      "metadata": {
+                                        "description": "Optional. softDelete data retention days. It accepts >=7 and <=90."
+                                      }
+                                    },
+                                    "enableRbacAuthorization": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC."
+                                      }
+                                    },
+                                    "createMode": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "allowedValues": [
+                                        "default",
+                                        "recover"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not."
+                                      }
+                                    },
+                                    "enablePurgeProtection": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature."
+                                      }
+                                    },
+                                    "sku": {
+                                      "type": "string",
+                                      "defaultValue": "premium",
+                                      "allowedValues": [
+                                        "premium",
+                                        "standard"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies the SKU for the vault."
+                                      }
+                                    },
+                                    "networkAcls": {
+                                      "$ref": "#/definitions/networkAclsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Rules governing the accessibility of the resource from specific network locations."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "allowedValues": [
+                                        "",
+                                        "Enabled",
+                                        "Disabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.KeyVault/vaults@2024-11-01#properties/tags"
+                                        },
+                                        "description": "Optional. Resource tags."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      },
+                                      {
+                                        "name": "formattedAccessPolicies",
+                                        "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
+                                        "input": {
+                                          "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
+                                          "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
+                                          "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
+                                          "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
+                                        }
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                                      "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
+                                      "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]",
+                                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                                      "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
+                                      "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
+                                      "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
+                                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                                      "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
+                                      "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.13.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "keyVault": {
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2024-11-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": {
+                                        "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
+                                        "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]",
+                                        "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
+                                        "enableSoftDelete": "[parameters('enableSoftDelete')]",
+                                        "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]",
+                                        "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]",
+                                        "createMode": "[parameters('createMode')]",
+                                        "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]",
+                                        "tenantId": "[subscription().tenantId]",
+                                        "accessPolicies": "[variables('formattedAccessPolicies')]",
+                                        "sku": {
+                                          "name": "[parameters('sku')]",
+                                          "family": "A"
+                                        },
+                                        "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
+                                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]"
+                                      }
+                                    },
+                                    "keyVault_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "keyVault_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "keyVault_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "keyVault_roleAssignments": {
+                                      "copy": {
+                                        "name": "keyVault_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "keyVault_accessPolicies": {
+                                      "condition": "[not(empty(parameters('accessPolicies')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "keyVaultName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "accessPolicies": {
+                                            "value": "[parameters('accessPolicies')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "8803020983329720581"
+                                            },
+                                            "name": "Key Vault Access Policies",
+                                            "description": "This module deploys a Key Vault Access Policy."
+                                          },
+                                          "definitions": {
+                                            "accessPoliciesType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "tenantId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
+                                                  }
+                                                },
+                                                "objectId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
+                                                  }
+                                                },
+                                                "applicationId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Application ID of the client making request on behalf of a principal."
+                                                  }
+                                                },
+                                                "permissions": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "keys": {
+                                                      "type": "array",
+                                                      "allowedValues": [
+                                                        "all",
+                                                        "backup",
+                                                        "create",
+                                                        "decrypt",
+                                                        "delete",
+                                                        "encrypt",
+                                                        "get",
+                                                        "getrotationpolicy",
+                                                        "import",
+                                                        "list",
+                                                        "purge",
+                                                        "recover",
+                                                        "release",
+                                                        "restore",
+                                                        "rotate",
+                                                        "setrotationpolicy",
+                                                        "sign",
+                                                        "unwrapKey",
+                                                        "update",
+                                                        "verify",
+                                                        "wrapKey"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Permissions to keys."
+                                                      }
+                                                    },
+                                                    "secrets": {
+                                                      "type": "array",
+                                                      "allowedValues": [
+                                                        "all",
+                                                        "backup",
+                                                        "delete",
+                                                        "get",
+                                                        "list",
+                                                        "purge",
+                                                        "recover",
+                                                        "restore",
+                                                        "set"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Permissions to secrets."
+                                                      }
+                                                    },
+                                                    "certificates": {
+                                                      "type": "array",
+                                                      "allowedValues": [
+                                                        "all",
+                                                        "backup",
+                                                        "create",
+                                                        "delete",
+                                                        "deleteissuers",
+                                                        "get",
+                                                        "getissuers",
+                                                        "import",
+                                                        "list",
+                                                        "listissuers",
+                                                        "managecontacts",
+                                                        "manageissuers",
+                                                        "purge",
+                                                        "recover",
+                                                        "restore",
+                                                        "setissuers",
+                                                        "update"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Permissions to certificates."
+                                                      }
+                                                    },
+                                                    "storage": {
+                                                      "type": "array",
+                                                      "allowedValues": [
+                                                        "all",
+                                                        "backup",
+                                                        "delete",
+                                                        "deletesas",
+                                                        "get",
+                                                        "getsas",
+                                                        "list",
+                                                        "listsas",
+                                                        "purge",
+                                                        "recover",
+                                                        "regeneratekey",
+                                                        "restore",
+                                                        "set",
+                                                        "setsas",
+                                                        "update"
+                                                      ],
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Permissions to storage accounts."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Permissions the identity has for keys, secrets and certificates."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for an access policy."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "keyVaultName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "accessPolicies": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/accessPoliciesType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.keyvault-accesspolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "keyVault": {
+                                              "existing": true,
+                                              "type": "Microsoft.KeyVault/vaults",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('keyVaultName')]"
+                                            },
+                                            "policies": {
+                                              "type": "Microsoft.KeyVault/vaults/accessPolicies",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "accessPolicies",
+                                                    "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
+                                                    "input": {
+                                                      "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'applicationId'), '')]",
+                                                      "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].objectId]",
+                                                      "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].permissions]",
+                                                      "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'tenantId'), tenant().tenantId)]"
+                                                    }
+                                                  }
+                                                ]
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the access policies assignment was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the access policies assignment."
+                                              },
+                                              "value": "add"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the access policies assignment."
+                                              },
+                                              "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "keyVault_secrets": {
+                                      "copy": {
+                                        "name": "keyVault_secrets",
+                                        "count": "[length(coalesce(parameters('secrets'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]"
+                                          },
+                                          "value": {
+                                            "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]"
+                                          },
+                                          "keyVaultName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "attributesEnabled": {
+                                            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'enabled')]"
+                                          },
+                                          "attributesExp": {
+                                            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'exp')]"
+                                          },
+                                          "attributesNbf": {
+                                            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'nbf')]"
+                                          },
+                                          "contentType": {
+                                            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "8701309639990049090"
+                                            },
+                                            "name": "Key Vault Secrets",
+                                            "description": "This module deploys a Key Vault Secret."
+                                          },
+                                          "definitions": {
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "keyVaultName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "minLength": 1,
+                                              "maxLength": 127,
+                                              "metadata": {
+                                                "description": "Required. The name of the secret (letters (upper and lower case), numbers, -)."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.KeyVault/vaults/secrets@2024-11-01#properties/tags"
+                                                },
+                                                "description": "Optional. Resource tags."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "attributesEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Determines whether the object is enabled."
+                                              }
+                                            },
+                                            "attributesExp": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                                              }
+                                            },
+                                            "attributesNbf": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                                              }
+                                            },
+                                            "contentType": {
+                                              "type": "securestring",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The content type of the secret."
+                                              }
+                                            },
+                                            "value": {
+                                              "type": "securestring",
+                                              "metadata": {
+                                                "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                                              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                                              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                                              "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
+                                              "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.keyvault-secret.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "keyVault": {
+                                              "existing": true,
+                                              "type": "Microsoft.KeyVault/vaults",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('keyVaultName')]"
+                                            },
+                                            "secret": {
+                                              "type": "Microsoft.KeyVault/vaults/secrets",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "contentType": "[parameters('contentType')]",
+                                                "attributes": {
+                                                  "enabled": "[parameters('attributesEnabled')]",
+                                                  "exp": "[parameters('attributesExp')]",
+                                                  "nbf": "[parameters('attributesNbf')]"
+                                                },
+                                                "value": "[parameters('value')]"
+                                              }
+                                            },
+                                            "secret_roleAssignments": {
+                                              "copy": {
+                                                "name": "secret_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "secret"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the secret."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the secret."
+                                              },
+                                              "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]"
+                                            },
+                                            "secretUri": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The uri of the secret."
+                                              },
+                                              "value": "[reference('secret').secretUri]"
+                                            },
+                                            "secretUriWithVersion": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The uri with version of the secret."
+                                              },
+                                              "value": "[reference('secret').secretUriWithVersion]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the secret was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "keyVault_keys": {
+                                      "copy": {
+                                        "name": "keyVault_keys",
+                                        "count": "[length(coalesce(parameters('keys'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]"
+                                          },
+                                          "keyVaultName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "attributesEnabled": {
+                                            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'enabled')]"
+                                          },
+                                          "attributesExp": {
+                                            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'exp')]"
+                                          },
+                                          "attributesNbf": {
+                                            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'nbf')]"
+                                          },
+                                          "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]",
+                                          "keyOps": {
+                                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]"
+                                          },
+                                          "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]",
+                                          "releasePolicy": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]"
+                                          },
+                                          "kty": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "rotationPolicy": {
+                                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "1266219369073699726"
+                                            },
+                                            "name": "Key Vault Keys",
+                                            "description": "This module deploys a Key Vault Key."
+                                          },
+                                          "definitions": {
+                                            "rotationPolicyType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "attributes": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "expiryTime": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The attributes of key rotation policy."
+                                                  }
+                                                },
+                                                "lifetimeActions": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "action": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "type": {
+                                                            "type": "string",
+                                                            "allowedValues": [
+                                                              "notify",
+                                                              "rotate"
+                                                            ],
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The type of the action."
+                                                            }
+                                                          }
+                                                        },
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The type of the action."
+                                                        }
+                                                      },
+                                                      "trigger": {
+                                                        "type": "object",
+                                                        "properties": {
+                                                          "timeAfterCreate": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                                                            }
+                                                          },
+                                                          "timeBeforeExpiry": {
+                                                            "type": "string",
+                                                            "nullable": true,
+                                                            "metadata": {
+                                                              "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
+                                                            }
+                                                          }
+                                                        },
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. The time duration for rotating the key."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The key rotation policy lifetime actions."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for a rotation policy."
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "keyVaultName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the key."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.KeyVault/vaults/keys@2024-11-01#properties/tags"
+                                                },
+                                                "description": "Optional. Resource tags."
+                                              },
+                                              "nullable": true
+                                            },
+                                            "attributesEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Determines whether the object is enabled."
+                                              }
+                                            },
+                                            "attributesExp": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
+                                              }
+                                            },
+                                            "attributesNbf": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
+                                              }
+                                            },
+                                            "curveName": {
+                                              "type": "string",
+                                              "defaultValue": "P-256",
+                                              "allowedValues": [
+                                                "P-256",
+                                                "P-256K",
+                                                "P-384",
+                                                "P-521"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The elliptic curve name."
+                                              }
+                                            },
+                                            "keyOps": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "allowedValues": [
+                                                "decrypt",
+                                                "encrypt",
+                                                "import",
+                                                "sign",
+                                                "unwrapKey",
+                                                "verify",
+                                                "wrapKey"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. Array of JsonWebKeyOperation."
+                                              }
+                                            },
+                                            "keySize": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA."
+                                              }
+                                            },
+                                            "kty": {
+                                              "type": "string",
+                                              "defaultValue": "EC",
+                                              "allowedValues": [
+                                                "EC",
+                                                "EC-HSM",
+                                                "RSA",
+                                                "RSA-HSM"
+                                              ],
+                                              "metadata": {
+                                                "description": "Optional. The type of the key."
+                                              }
+                                            },
+                                            "releasePolicy": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key release policy."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "rotationPolicy": {
+                                              "$ref": "#/definitions/rotationPolicyType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Key rotation policy properties object."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
+                                              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
+                                              "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
+                                              "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
+                                              "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
+                                              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.keyvault-key.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "keyVault": {
+                                              "existing": true,
+                                              "type": "Microsoft.KeyVault/vaults",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('keyVaultName')]"
+                                            },
+                                            "key": {
+                                              "type": "Microsoft.KeyVault/vaults/keys",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": "[shallowMerge(createArray(createObject('attributes', createObject('enabled', parameters('attributesEnabled'), 'exp', parameters('attributesExp'), 'nbf', parameters('attributesNbf')), 'curveName', parameters('curveName'), 'keyOps', parameters('keyOps'), 'keySize', parameters('keySize'), 'kty', parameters('kty'), 'release_policy', coalesce(parameters('releasePolicy'), createObject())), if(not(empty(parameters('rotationPolicy'))), createObject('rotationPolicy', parameters('rotationPolicy')), createObject())))]"
+                                            },
+                                            "key_roleAssignments": {
+                                              "copy": {
+                                                "name": "key_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "key"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "keyUri": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The uri of the key."
+                                              },
+                                              "value": "[reference('key').keyUri]"
+                                            },
+                                            "keyUriWithVersion": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The uri with version of the key."
+                                              },
+                                              "value": "[reference('key').keyUriWithVersion]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the key."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the key."
+                                              },
+                                              "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the key was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    },
+                                    "keyVault_privateEndpoints": {
+                                      "copy": {
+                                        "name": "keyVault_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.34.44.8038",
+                                              "templateHash": "12389807800450456797"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "ipConfigurationType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "memberName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "privateIPAddress": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private endpoint IP configurations."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "privateLinkServiceConnectionType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the private link service connection."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupIds": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                                      }
+                                                    },
+                                                    "privateLinkServiceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource id of private link service."
+                                                      }
+                                                    },
+                                                    "requestMessage": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private link service connection."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "customDnsConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                                  }
+                                                },
+                                                "ipAddresses": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/ipConfigurationType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              }
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              }
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS configurations."
+                                              }
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.34.44.8038",
+                                                      "templateHash": "13997305779829540948"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "privateDnsZoneConfigsVar",
+                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                        "input": {
+                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                                          "properties": {
+                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                                          }
+                                                        }
+                                                      }
+                                                    ]
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "metadata": {
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "keyVault"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the key vault."
+                                      },
+                                      "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the key vault was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the key vault."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "uri": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The URI of the key vault."
+                                      },
+                                      "value": "[reference('keyVault').vaultUri]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('keyVault', '2024-11-01', 'full').location]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the key vault."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    },
+                                    "secrets": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/credentialOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The properties of the created secrets."
+                                      },
+                                      "copy": {
+                                        "count": "[length(range(0, length(coalesce(parameters('secrets'), createArray()))))]",
+                                        "input": {
+                                          "resourceId": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.resourceId.value]",
+                                          "uri": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUri.value]",
+                                          "uriWithVersion": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUriWithVersion.value]"
+                                        }
+                                      }
+                                    },
+                                    "keys": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/credentialOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The properties of the created keys."
+                                      },
+                                      "copy": {
+                                        "count": "[length(range(0, length(coalesce(parameters('keys'), createArray()))))]",
+                                        "input": {
+                                          "resourceId": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.resourceId.value]",
+                                          "uri": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUri.value]",
+                                          "uriWithVersion": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUriWithVersion.value]"
+                                        }
+                                      }
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the Key Vault."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.name.value, variables('existingName'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the Key Vault."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.KeyVault/vaults', variables('existingName')))]"
+                            },
+                            "subscriptionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Subscription ID of the Key Vault."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource Group Name of the Key Vault."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "aiSearch": {
+                      "condition": "[parameters('includeAssociatedResources')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('module.aiSearch.{0}', variables('resourcesName')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "existingResourceId": {
+                            "value": "[tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')]"
+                          },
+                          "name": {
+                            "value": "[take(if(not(empty(tryGet(parameters('aiSearchConfiguration'), 'name'))), parameters('aiSearchConfiguration').name, format('srch{0}', variables('resourcesName'))), 60)]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "privateEndpointSubnetResourceId": {
+                            "value": "[parameters('privateEndpointSubnetResourceId')]"
+                          },
+                          "privateDnsZoneResourceId": {
+                            "value": "[tryGet(parameters('aiSearchConfiguration'), 'privateDnsZoneResourceId')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('aiSearchConfiguration'), 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "2804046174313565921"
+                            }
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "functions": [
+                            {
+                              "namespace": "__bicep",
+                              "members": {
+                                "getResourceGroupName": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Group Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceName": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    },
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceParts": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
+                                  },
+                                  "metadata": {
+                                    "description": "Splits Resource ID into its components.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getSubscriptionId": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Subscription ID from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          ],
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "maxLength": 60,
+                              "metadata": {
+                                "description": "Required. The name of the AI Search resource."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The location for the AI Search resource."
+                              }
+                            },
+                            "existingResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The full resource ID of an existing AI Search resource to use instead of creating a new one."
+                              }
+                            },
+                            "privateEndpointSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints."
+                              }
+                            },
+                            "privateDnsZoneResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the private DNS zone for the AI Search resource to establish private endpoints."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the role assignments for the AI Search resource."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Specifies the resource tags for all the resources."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
+                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
+                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
+                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
+                            "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
+                          },
+                          "resources": {
+                            "existingSearchService": {
+                              "condition": "[not(empty(parameters('existingResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Search/searchServices",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[variables('existingSubscriptionId')]",
+                              "resourceGroup": "[variables('existingResourceGroupName')]",
+                              "name": "[variables('existingName')]"
+                            },
+                            "aiSearch": {
+                              "condition": "[empty(parameters('existingResourceId'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('avm.res.search.search-service.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[parameters('enableTelemetry')]"
+                                  },
+                                  "cmkEnforcement": {
+                                    "value": "Unspecified"
+                                  },
+                                  "managedIdentities": {
+                                    "value": {
+                                      "systemAssigned": true
+                                    }
+                                  },
+                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                                  "disableLocalAuth": {
+                                    "value": "[variables('privateNetworkingEnabled')]"
+                                  },
+                                  "authOptions": "[if(variables('privateNetworkingEnabled'), createObject('value', null()), createObject('value', createObject('aadOrApiKey', createObject('aadAuthFailureMode', 'http401WithBearerChallenge'))))]",
+                                  "sku": {
+                                    "value": "standard"
+                                  },
+                                  "partitionCount": {
+                                    "value": 1
+                                  },
+                                  "replicaCount": {
+                                    "value": 3
+                                  },
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  },
+                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
+                                  "tags": {
+                                    "value": "[parameters('tags')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "10902281417196168235"
+                                    },
+                                    "name": "Search Services",
+                                    "description": "This module deploys a Search Service."
+                                  },
+                                  "definitions": {
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group Id for the private endpoint Group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "FQDN that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses of the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "secretsExportConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The key vault name where to store the API Admin keys generated by the modules."
+                                          }
+                                        },
+                                        "primaryAdminKeyName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The primaryAdminKey secret name to create."
+                                          }
+                                        },
+                                        "secondaryAdminKeyName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The secondaryAdminKey secret name to create."
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "secretsOutputType": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "$ref": "#/definitions/secretSetType",
+                                        "metadata": {
+                                          "description": "An exported secret's references."
+                                        }
+                                      }
+                                    },
+                                    "authOptionsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "aadOrApiKey": {
+                                          "type": "object",
+                                          "properties": {
+                                            "aadAuthFailureMode": {
+                                              "type": "string",
+                                              "allowedValues": [
+                                                "http401WithBearerChallenge",
+                                                "http403"
+                                              ],
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Describes what response the data plane API of a search service would send for requests that failed authentication."
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Indicates that either the API key or an access token from a Microsoft Entra ID tenant can be used for authentication."
+                                          }
+                                        },
+                                        "apiKeyOnly": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Indicates that only the API key can be used for authentication."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "networkRuleSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "bypass": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzurePortal",
+                                            "AzureServices",
+                                            "None"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Network specific rules that determine how the Azure AI Search service may be reached."
+                                          }
+                                        },
+                                        "ipRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/ipRuleType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP restriction rules that defines the inbound network(s) with allowing access to the search service endpoint. At the meantime, all other public IP networks are blocked by the firewall. These restriction rules are applied only when the 'publicNetworkAccess' of the search service is 'enabled'; otherwise, traffic over public interface is not allowed even with any public IP rules, and private endpoint connections would be the exclusive access method."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "ipRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "value": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Value corresponding to a single IPv4 address (eg., 123.1.2.3) or an IP range in CIDR format (eg., 123.1.2.3/24) to be allowed."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true
+                                      }
+                                    },
+                                    "_1.lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointSingleServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private Endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the Private Endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/_1.lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                        }
+                                      }
+                                    },
+                                    "secretSetType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "modules/keyVaultExport.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Azure Cognitive Search service to create or update. Search service names must only contain lowercase letters, digits or dashes, cannot use dash as the first two or last one characters, cannot contain consecutive dashes, and must be between 2 and 60 characters in length. Search service names must be globally unique since they are part of the service URI (https://<name>.search.windows.net). You cannot change the service name after the service is created."
+                                      }
+                                    },
+                                    "authOptions": {
+                                      "$ref": "#/definitions/authOptionsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Defines the options for how the data plane API of a Search service authenticates requests. Must remain an empty object {} if 'disableLocalAuth' is set to true."
+                                      }
+                                    },
+                                    "disableLocalAuth": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. When set to true, calls to the search service will not be permitted to utilize API keys for authentication. This cannot be set to true if 'authOptions' are defined."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "cmkEnforcement": {
+                                      "type": "string",
+                                      "defaultValue": "Unspecified",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled",
+                                        "Unspecified"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Describes a policy that determines how resources within the search service are to be encrypted with Customer Managed Keys."
+                                      }
+                                    },
+                                    "hostingMode": {
+                                      "type": "string",
+                                      "defaultValue": "default",
+                                      "allowedValues": [
+                                        "default",
+                                        "highDensity"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Applicable only for the standard3 SKU. You can set this property to enable up to 3 high density partitions that allow up to 1000 indexes, which is much higher than the maximum indexes allowed for any other SKU. For the standard3 SKU, the value is either 'default' or 'highDensity'. For all other SKUs, this value must be 'default'."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all Resources."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings for all Resources in the solution."
+                                      }
+                                    },
+                                    "networkRuleSet": {
+                                      "$ref": "#/definitions/networkRuleSetType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Network specific rules that determine how the Azure Cognitive Search service may be reached."
+                                      }
+                                    },
+                                    "partitionCount": {
+                                      "type": "int",
+                                      "defaultValue": 1,
+                                      "minValue": 1,
+                                      "maxValue": 12,
+                                      "metadata": {
+                                        "description": "Optional. The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                                      }
+                                    },
+                                    "sharedPrivateLinkResources": {
+                                      "type": "array",
+                                      "defaultValue": [],
+                                      "metadata": {
+                                        "description": "Optional. The sharedPrivateLinkResources to create as part of the search Service."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "defaultValue": "Enabled",
+                                      "allowedValues": [
+                                        "Enabled",
+                                        "Disabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method."
+                                      }
+                                    },
+                                    "secretsExportConfiguration": {
+                                      "$ref": "#/definitions/secretsExportConfigurationType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                                      }
+                                    },
+                                    "replicaCount": {
+                                      "type": "int",
+                                      "defaultValue": 3,
+                                      "minValue": 1,
+                                      "maxValue": 12,
+                                      "metadata": {
+                                        "description": "Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "semanticSearch": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "disabled",
+                                        "free",
+                                        "standard"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations."
+                                      }
+                                    },
+                                    "sku": {
+                                      "type": "string",
+                                      "defaultValue": "standard",
+                                      "allowedValues": [
+                                        "basic",
+                                        "free",
+                                        "standard",
+                                        "standard2",
+                                        "standard3",
+                                        "storage_optimized_l1",
+                                        "storage_optimized_l2"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Defines the SKU of an Azure Cognitive Search Service, which determines price tier and capacity limits."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Search/searchServices@2025-02-01-preview#properties/tags"
+                                        },
+                                        "description": "Optional. Tags to help categorize the resource in the Azure portal."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', '')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Search Index Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
+                                      "Search Index Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]",
+                                      "Search Service Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "searchService": {
+                                      "type": "Microsoft.Search/searchServices",
+                                      "apiVersion": "2025-02-01-preview",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "sku": {
+                                        "name": "[parameters('sku')]"
+                                      },
+                                      "tags": "[parameters('tags')]",
+                                      "identity": "[variables('identity')]",
+                                      "properties": {
+                                        "authOptions": "[parameters('authOptions')]",
+                                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
+                                        "encryptionWithCmk": {
+                                          "enforcement": "[parameters('cmkEnforcement')]"
+                                        },
+                                        "hostingMode": "[parameters('hostingMode')]",
+                                        "networkRuleSet": "[parameters('networkRuleSet')]",
+                                        "partitionCount": "[parameters('partitionCount')]",
+                                        "replicaCount": "[parameters('replicaCount')]",
+                                        "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]",
+                                        "semanticSearch": "[parameters('semanticSearch')]"
+                                      }
+                                    },
+                                    "searchService_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "searchService_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "searchService"
+                                      ]
+                                    },
+                                    "searchService_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "searchService"
+                                      ]
+                                    },
+                                    "searchService_roleAssignments": {
+                                      "copy": {
+                                        "name": "searchService_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Search/searchServices', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "searchService"
+                                      ]
+                                    },
+                                    "searchService_privateEndpoints": {
+                                      "copy": {
+                                        "name": "searchService_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-searchService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.34.44.8038",
+                                              "templateHash": "12389807800450456797"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "ipConfigurationType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "memberName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "privateIPAddress": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private endpoint IP configurations."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "privateLinkServiceConnectionType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the private link service connection."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupIds": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                                      }
+                                                    },
+                                                    "privateLinkServiceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource id of private link service."
+                                                      }
+                                                    },
+                                                    "requestMessage": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private link service connection."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "customDnsConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                                  }
+                                                },
+                                                "ipAddresses": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/ipConfigurationType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              }
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              }
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS configurations."
+                                              }
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.34.44.8038",
+                                                      "templateHash": "13997305779829540948"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "privateDnsZoneConfigsVar",
+                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                        "input": {
+                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                                          "properties": {
+                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                                          }
+                                                        }
+                                                      }
+                                                    ]
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "metadata": {
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "searchService"
+                                      ]
+                                    },
+                                    "searchService_sharedPrivateLinkResources": {
+                                      "copy": {
+                                        "name": "searchService_sharedPrivateLinkResources",
+                                        "count": "[length(parameters('sharedPrivateLinkResources'))]",
+                                        "mode": "serial",
+                                        "batchSize": 1
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-searchService-SharedPrvLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]"
+                                          },
+                                          "searchServiceName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "privateLinkResourceId": {
+                                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].privateLinkResourceId]"
+                                          },
+                                          "groupId": {
+                                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].groupId]"
+                                          },
+                                          "requestMessage": {
+                                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].requestMessage]"
+                                          },
+                                          "resourceRegion": {
+                                            "value": "[tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'resourceRegion')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "557730297583881254"
+                                            },
+                                            "name": "Search Services Private Link Resources",
+                                            "description": "This module deploys a Search Service Private Link Resource."
+                                          },
+                                          "parameters": {
+                                            "searchServiceName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent searchServices. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the shared private link resource managed by the Azure Cognitive Search service within the specified resource group."
+                                              }
+                                            },
+                                            "privateLinkResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The resource ID of the resource the shared private link resource is for."
+                                              }
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The group ID from the provider of resource the shared private link resource is for."
+                                              }
+                                            },
+                                            "requestMessage": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The request message for requesting approval of the shared private link resource."
+                                              }
+                                            },
+                                            "resourceRegion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Can be used to specify the Azure Resource Manager location of the resource to which a shared private link is to be created. This is only required for those resources whose DNS configuration are regional (such as Azure Kubernetes Service)."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "searchService": {
+                                              "existing": true,
+                                              "type": "Microsoft.Search/searchServices",
+                                              "apiVersion": "2025-02-01-preview",
+                                              "name": "[parameters('searchServiceName')]"
+                                            },
+                                            "sharedPrivateLinkResource": {
+                                              "type": "Microsoft.Search/searchServices/sharedPrivateLinkResources",
+                                              "apiVersion": "2025-02-01-preview",
+                                              "name": "[format('{0}/{1}', parameters('searchServiceName'), parameters('name'))]",
+                                              "properties": {
+                                                "privateLinkResourceId": "[parameters('privateLinkResourceId')]",
+                                                "groupId": "[parameters('groupId')]",
+                                                "requestMessage": "[parameters('requestMessage')]",
+                                                "resourceRegion": "[parameters('resourceRegion')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the shared private link resource."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the shared private link resource."
+                                              },
+                                              "value": "[resourceId('Microsoft.Search/searchServices/sharedPrivateLinkResources', parameters('searchServiceName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the shared private link resource was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "searchService"
+                                      ]
+                                    },
+                                    "secretsExport": {
+                                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "keyVaultName": {
+                                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                          },
+                                          "secretsToSet": {
+                                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').primaryKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').secondaryKey)), createArray()))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "7634110751636246703"
+                                            }
+                                          },
+                                          "definitions": {
+                                            "secretSetType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "secretResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The resourceId of the exported secret."
+                                                  }
+                                                },
+                                                "secretUri": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The secret URI of the exported secret."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "secretToSetType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the secret to set."
+                                                  }
+                                                },
+                                                "value": {
+                                                  "type": "securestring",
+                                                  "metadata": {
+                                                    "description": "Required. The value of the secret to set."
+                                                  }
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "keyVaultName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                                              }
+                                            },
+                                            "secretsToSet": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/secretToSetType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. The secrets to set in the Key Vault."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "keyVault": {
+                                              "existing": true,
+                                              "type": "Microsoft.KeyVault/vaults",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('keyVaultName')]"
+                                            },
+                                            "secrets": {
+                                              "copy": {
+                                                "name": "secrets",
+                                                "count": "[length(parameters('secretsToSet'))]"
+                                              },
+                                              "type": "Microsoft.KeyVault/vaults/secrets",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                              "properties": {
+                                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "secretsSet": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/secretSetType"
+                                              },
+                                              "metadata": {
+                                                "description": "The references to the secrets exported to the provided Key Vault."
+                                              },
+                                              "copy": {
+                                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                                "input": {
+                                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
+                                                }
+                                              }
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "searchService"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the search service."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the search service."
+                                      },
+                                      "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the search service was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('searchService', '2025-02-01-preview', 'full'), 'identity'), 'principalId')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('searchService', '2025-02-01-preview', 'full').location]"
+                                    },
+                                    "endpoint": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The endpoint of the search service."
+                                      },
+                                      "value": "[reference('searchService').endpoint]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the search service."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    },
+                                    "exportedSecrets": {
+                                      "$ref": "#/definitions/secretsOutputType",
+                                      "metadata": {
+                                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                                      },
+                                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                                    },
+                                    "primaryKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary admin API key of the search service."
+                                      },
+                                      "value": "[listAdminKeys('searchService', '2025-02-01-preview').primaryKey]"
+                                    },
+                                    "secondaryKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondaryKey admin API key of the search service."
+                                      },
+                                      "value": "[listAdminKeys('searchService', '2025-02-01-preview').secondaryKey]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the AI Search resource."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.name.value, variables('existingName'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the AI Search resource."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Search/searchServices', variables('existingName')))]"
+                            },
+                            "subscriptionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Subscription ID of the AI Search resource."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource Group Name of the AI Search resource."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
+                            },
+                            "systemAssignedMIPrincipalId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "System assigned managed identity principal ID of the AI Search resource."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, '')]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "storageAccount": {
+                      "condition": "[parameters('includeAssociatedResources')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('module.storageAccount.{0}', variables('resourcesName')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "existingResourceId": {
+                            "value": "[tryGet(parameters('storageAccountConfiguration'), 'existingResourceId')]"
+                          },
+                          "name": {
+                            "value": "[take(if(not(empty(tryGet(parameters('storageAccountConfiguration'), 'name'))), parameters('storageAccountConfiguration').name, format('st{0}', variables('resourcesName'))), 24)]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "privateEndpointSubnetResourceId": {
+                            "value": "[parameters('privateEndpointSubnetResourceId')]"
+                          },
+                          "blobPrivateDnsZoneResourceId": {
+                            "value": "[tryGet(parameters('storageAccountConfiguration'), 'blobPrivateDnsZoneResourceId')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[concat(if(and(not(empty(parameters('storageAccountConfiguration'))), not(empty(tryGet(parameters('storageAccountConfiguration'), 'roleAssignments')))), parameters('storageAccountConfiguration').roleAssignments, createArray()), createArray(createObject('principalId', reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), if(empty(tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')), createArray(createObject('principalId', reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), createArray()))]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "10412454114821386555"
+                            }
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "functions": [
+                            {
+                              "namespace": "__bicep",
+                              "members": {
+                                "getResourceGroupName": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Group Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceName": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    },
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceParts": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
+                                  },
+                                  "metadata": {
+                                    "description": "Splits Resource ID into its components.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getSubscriptionId": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Subscription ID from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          ],
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "maxLength": 24,
+                              "metadata": {
+                                "description": "Required. The name of the storage account."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The location for the storage account."
+                              }
+                            },
+                            "existingResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The full resource ID of an existing storage account to use instead of creating a new one."
+                              }
+                            },
+                            "privateEndpointSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'blobPrivateDnsZoneResourceId' to establish private endpoints."
+                              }
+                            },
+                            "blobPrivateDnsZoneResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the private DNS zone for the storage account blob service to establish private endpoints."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the role assignments for the storage account."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Specifies the resource tags for all the resources."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
+                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
+                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
+                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
+                            "privateNetworkingEnabled": "[and(not(empty(parameters('blobPrivateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
+                          },
+                          "resources": {
+                            "existingStorageAccount": {
+                              "condition": "[not(empty(parameters('existingResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-01-01",
+                              "subscriptionId": "[variables('existingSubscriptionId')]",
+                              "resourceGroup": "[variables('existingResourceGroupName')]",
+                              "name": "[variables('existingName')]"
+                            },
+                            "storageAccount": {
+                              "condition": "[empty(parameters('existingResourceId'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('avm.res.storage.storage-account.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "tags": {
+                                    "value": "[parameters('tags')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[parameters('enableTelemetry')]"
+                                  },
+                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
+                                  "accessTier": {
+                                    "value": "Hot"
+                                  },
+                                  "allowBlobPublicAccess": {
+                                    "value": "[not(variables('privateNetworkingEnabled'))]"
+                                  },
+                                  "allowSharedKeyAccess": {
+                                    "value": false
+                                  },
+                                  "allowCrossTenantReplication": {
+                                    "value": false
+                                  },
+                                  "blobServices": {
+                                    "value": {
+                                      "deleteRetentionPolicyEnabled": true,
+                                      "deleteRetentionPolicyDays": 7,
+                                      "containerDeleteRetentionPolicyEnabled": true,
+                                      "containerDeleteRetentionPolicyDays": 7
+                                    }
+                                  },
+                                  "minimumTlsVersion": {
+                                    "value": "TLS1_2"
+                                  },
+                                  "networkAcls": {
+                                    "value": {
+                                      "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]",
+                                      "bypass": "AzureServices"
+                                    }
+                                  },
+                                  "supportsHttpsTrafficOnly": {
+                                    "value": true
+                                  },
+                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('blobPrivateDnsZoneResourceId')))), 'service', 'blob', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "3530476863855541150"
+                                    },
+                                    "name": "Storage Accounts",
+                                    "description": "This module deploys a Storage Account."
+                                  },
+                                  "definitions": {
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group Id for the private endpoint Group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "FQDN that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses of the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the private endpoints output."
+                                      }
+                                    },
+                                    "networkAclsType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "resourceAccessRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "tenantId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The ID of the tenant in which the resource resides in."
+                                                }
+                                              },
+                                              "resourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
+                                          }
+                                        },
+                                        "bypass": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureServices",
+                                            "AzureServices, Logging",
+                                            "AzureServices, Logging, Metrics",
+                                            "AzureServices, Metrics",
+                                            "Logging",
+                                            "Logging, Metrics",
+                                            "Metrics",
+                                            "None"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
+                                          }
+                                        },
+                                        "virtualNetworkRules": {
+                                          "type": "array",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Sets the virtual network rules."
+                                          }
+                                        },
+                                        "ipRules": {
+                                          "type": "array",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Sets the IP ACL rules."
+                                          }
+                                        },
+                                        "defaultAction": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Allow",
+                                            "Deny"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies the default action of allow or deny when no other rules match."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the network configuration."
+                                      }
+                                    },
+                                    "secretsExportConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
+                                          }
+                                        },
+                                        "accessKey1Name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The accessKey1 secret name to create."
+                                          }
+                                        },
+                                        "connectionString1Name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The connectionString1 secret name to create."
+                                          }
+                                        },
+                                        "accessKey2Name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The accessKey2 secret name to create."
+                                          }
+                                        },
+                                        "connectionString2Name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The connectionString2 secret name to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of the exported secrets."
+                                      }
+                                    },
+                                    "localUserType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the local user used for SFTP Authentication."
+                                          }
+                                        },
+                                        "hasSharedKey": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                                          }
+                                        },
+                                        "hasSshKey": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                                          }
+                                        },
+                                        "hasSshPassword": {
+                                          "type": "bool",
+                                          "metadata": {
+                                            "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                                          }
+                                        },
+                                        "homeDirectory": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The local user home directory."
+                                          }
+                                        },
+                                        "permissionScopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/permissionScopeType"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The permission scopes of the local user."
+                                          }
+                                        },
+                                        "sshAuthorizedKeys": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/sshAuthorizedKeyType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The local user SSH authorized keys for SFTP."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a local user."
+                                      }
+                                    },
+                                    "blobServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "automaticSnapshotPolicyEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Automatic Snapshot is enabled if set to true."
+                                          }
+                                        },
+                                        "changeFeedEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                                          }
+                                        },
+                                        "changeFeedRetentionInDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "minValue": 1,
+                                          "maxValue": 146000,
+                                          "metadata": {
+                                            "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                                          }
+                                        },
+                                        "containerDeleteRetentionPolicyEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                                          }
+                                        },
+                                        "containerDeleteRetentionPolicyDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "minValue": 1,
+                                          "maxValue": 365,
+                                          "metadata": {
+                                            "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                                          }
+                                        },
+                                        "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                          }
+                                        },
+                                        "corsRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/corsRuleType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                          }
+                                        },
+                                        "defaultServiceVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                                          }
+                                        },
+                                        "deleteRetentionPolicyEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The blob service properties for blob soft delete."
+                                          }
+                                        },
+                                        "deleteRetentionPolicyDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "minValue": 1,
+                                          "maxValue": 365,
+                                          "metadata": {
+                                            "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                                          }
+                                        },
+                                        "deleteRetentionPolicyAllowPermanentDelete": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                          }
+                                        },
+                                        "isVersioningEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                                          }
+                                        },
+                                        "lastAccessTimeTrackingPolicyEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                                          }
+                                        },
+                                        "restorePolicyEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                                          }
+                                        },
+                                        "restorePolicyDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "minValue": 1,
+                                          "metadata": {
+                                            "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                                          }
+                                        },
+                                        "containers": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/containerType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Blob containers to create."
+                                          }
+                                        },
+                                        "diagnosticSettings": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/diagnosticSettingFullType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The diagnostic settings of the service."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type of a blob service."
+                                      }
+                                    },
+                                    "_1.immutabilityPolicyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "immutabilityPeriodSinceCreationInDays": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                          }
+                                        },
+                                        "allowProtectedAppendWrites": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                                          }
+                                        },
+                                        "allowProtectedAppendWritesAll": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for an immutability policy.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "blob-service/container/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "_2.secretSetOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "secretResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resourceId of the exported secret."
+                                          }
+                                        },
+                                        "secretUri": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI of the exported secret."
+                                          }
+                                        },
+                                        "secretUriWithVersion": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The secret URI with version of the exported secret."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "_3.lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_3.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_3.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_3.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_3.roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "containerType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the Storage Container to deploy."
+                                          }
+                                        },
+                                        "defaultEncryptionScope": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                          }
+                                        },
+                                        "denyEncryptionScopeOverride": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Block override of encryption scope from the container default."
+                                          }
+                                        },
+                                        "enableNfsV3AllSquash": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable NFSv3 all squash on blob container."
+                                          }
+                                        },
+                                        "enableNfsV3RootSquash": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable NFSv3 root squash on blob container."
+                                          }
+                                        },
+                                        "immutableStorageWithVersioningEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                          }
+                                        },
+                                        "immutabilityPolicy": {
+                                          "$ref": "#/definitions/_1.immutabilityPolicyType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Configure immutability policy."
+                                          }
+                                        },
+                                        "metadata": {
+                                          "type": "object",
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                            },
+                                            "description": "Optional. A name-value pair to associate with the container as metadata."
+                                          },
+                                          "nullable": true
+                                        },
+                                        "publicAccess": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Blob",
+                                            "Container",
+                                            "None"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_3.roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type of a storage container.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "blob-service/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "corsRuleType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "allowedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                          }
+                                        },
+                                        "allowedMethods": {
+                                          "type": "array",
+                                          "allowedValues": [
+                                            "CONNECT",
+                                            "DELETE",
+                                            "GET",
+                                            "HEAD",
+                                            "MERGE",
+                                            "OPTIONS",
+                                            "PATCH",
+                                            "POST",
+                                            "PUT",
+                                            "TRACE"
+                                          ],
+                                          "metadata": {
+                                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                          }
+                                        },
+                                        "allowedOrigins": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                          }
+                                        },
+                                        "exposedHeaders": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of response headers to expose to CORS clients."
+                                          }
+                                        },
+                                        "maxAgeInSeconds": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for a cors rule.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "blob-service/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "customerManagedKeyWithAutoRotateType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "keyVaultResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
+                                          }
+                                        },
+                                        "keyName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the customer managed key to use for encryption."
+                                          }
+                                        },
+                                        "keyVersion": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
+                                          }
+                                        },
+                                        "autoRotationEnabled": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
+                                          }
+                                        },
+                                        "userAssignedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingMetricsOnlyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of diagnostic setting."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "permissionScopeType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "permissions": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                                          }
+                                        },
+                                        "resourceName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The service used by the local user, e.g. blob, file."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "local-user/main.bicep"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointMultiServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the private endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_3.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/_3.lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_3.roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "secretsOutputType": {
+                                      "type": "object",
+                                      "properties": {},
+                                      "additionalProperties": {
+                                        "$ref": "#/definitions/_2.secretSetOutputType",
+                                        "metadata": {
+                                          "description": "An exported secret's references."
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "A map of the exported secrets",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                        }
+                                      }
+                                    },
+                                    "sshAuthorizedKeyType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Description used to store the function/usage of the key."
+                                          }
+                                        },
+                                        "key": {
+                                          "type": "securestring",
+                                          "metadata": {
+                                            "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "local-user/main.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "maxLength": 24,
+                                      "metadata": {
+                                        "description": "Required. Name of the Storage Account. Must be lower-case."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Location for all resources."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Array of role assignments to create."
+                                      }
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "kind": {
+                                      "type": "string",
+                                      "defaultValue": "StorageV2",
+                                      "allowedValues": [
+                                        "Storage",
+                                        "StorageV2",
+                                        "BlobStorage",
+                                        "FileStorage",
+                                        "BlockBlobStorage"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Type of Storage Account to create."
+                                      }
+                                    },
+                                    "skuName": {
+                                      "type": "string",
+                                      "defaultValue": "Standard_GRS",
+                                      "allowedValues": [
+                                        "Standard_LRS",
+                                        "Standard_ZRS",
+                                        "Standard_GRS",
+                                        "Standard_GZRS",
+                                        "Standard_RAGRS",
+                                        "Standard_RAGZRS",
+                                        "StandardV2_LRS",
+                                        "StandardV2_ZRS",
+                                        "StandardV2_GRS",
+                                        "StandardV2_GZRS",
+                                        "Premium_LRS",
+                                        "Premium_ZRS",
+                                        "PremiumV2_LRS",
+                                        "PremiumV2_ZRS"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage."
+                                      }
+                                    },
+                                    "accessTier": {
+                                      "type": "string",
+                                      "defaultValue": "Hot",
+                                      "allowedValues": [
+                                        "Premium",
+                                        "Hot",
+                                        "Cool",
+                                        "Cold"
+                                      ],
+                                      "metadata": {
+                                        "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
+                                      }
+                                    },
+                                    "largeFileSharesState": {
+                                      "type": "string",
+                                      "defaultValue": "Disabled",
+                                      "allowedValues": [
+                                        "Disabled",
+                                        "Enabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
+                                      }
+                                    },
+                                    "azureFilesIdentityBasedAuthentication": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication"
+                                        },
+                                        "description": "Optional. Provides the identity based authentication settings for Azure Files."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "defaultToOAuthAuthentication": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
+                                      }
+                                    },
+                                    "allowSharedKeyAccess": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointMultiServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
+                                      }
+                                    },
+                                    "managementPolicyRules": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The Storage Account ManagementPolicies Rules."
+                                      }
+                                    },
+                                    "networkAcls": {
+                                      "$ref": "#/definitions/networkAclsType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
+                                      }
+                                    },
+                                    "requireInfrastructureEncryption": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
+                                      }
+                                    },
+                                    "allowCrossTenantReplication": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Allow or disallow cross AAD tenant object replication."
+                                      }
+                                    },
+                                    "customDomainName": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
+                                      }
+                                    },
+                                    "customDomainUseSubDomainName": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
+                                      }
+                                    },
+                                    "dnsEndpointType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "AzureDnsZone",
+                                        "Standard"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
+                                      }
+                                    },
+                                    "blobServices": {
+                                      "$ref": "#/definitions/blobServiceType",
+                                      "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
+                                      "metadata": {
+                                        "description": "Optional. Blob service and containers to deploy."
+                                      }
+                                    },
+                                    "fileServices": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. File service and shares to deploy."
+                                      }
+                                    },
+                                    "queueServices": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Queue service and queues to create."
+                                      }
+                                    },
+                                    "tableServices": {
+                                      "type": "object",
+                                      "defaultValue": {},
+                                      "metadata": {
+                                        "description": "Optional. Table service and tables to create."
+                                      }
+                                    },
+                                    "allowBlobPublicAccess": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
+                                      }
+                                    },
+                                    "minimumTlsVersion": {
+                                      "type": "string",
+                                      "defaultValue": "TLS1_2",
+                                      "allowedValues": [
+                                        "TLS1_2"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore."
+                                      }
+                                    },
+                                    "enableHierarchicalNamespace": {
+                                      "type": "bool",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
+                                      }
+                                    },
+                                    "enableSftp": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
+                                      }
+                                    },
+                                    "localUsers": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/localUserType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Local users to deploy for SFTP authentication."
+                                      }
+                                    },
+                                    "isLocalUserEnabled": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Enables local users feature, if set to true."
+                                      }
+                                    },
+                                    "enableNfsV3": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings of the service."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags"
+                                        },
+                                        "description": "Optional. Tags of the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "allowedCopyScope": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "AAD",
+                                        "PrivateLink"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
+                                      }
+                                    },
+                                    "publicNetworkAccess": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Enabled",
+                                        "Disabled"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
+                                      }
+                                    },
+                                    "supportsHttpsTrafficOnly": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
+                                      }
+                                    },
+                                    "customerManagedKey": {
+                                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The customer managed key definition."
+                                      }
+                                    },
+                                    "sasExpirationPeriod": {
+                                      "type": "string",
+                                      "defaultValue": "",
+                                      "metadata": {
+                                        "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
+                                      }
+                                    },
+                                    "sasExpirationAction": {
+                                      "type": "string",
+                                      "defaultValue": "Log",
+                                      "allowedValues": [
+                                        "Block",
+                                        "Log"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The SAS expiration action. Allowed values are Block and Log."
+                                      }
+                                    },
+                                    "keyType": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "Account",
+                                        "Service"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The keyType to use with Queue & Table services."
+                                      }
+                                    },
+                                    "secretsExportConfiguration": {
+                                      "$ref": "#/definitions/secretsExportConfigurationType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
+                                      }
+                                    },
+                                    "immutableStorageWithVersioning": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning"
+                                        },
+                                        "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts."
+                                      },
+                                      "nullable": true
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]",
+                                    "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                                    "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "builtInRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                                      "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
+                                      "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
+                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "cMKKeyVault::cMKKey": {
+                                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults/keys",
+                                      "apiVersion": "2024-11-01",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
+                                    },
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-03-01",
+                                      "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "cMKKeyVault": {
+                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.KeyVault/vaults",
+                                      "apiVersion": "2024-11-01",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
+                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
+                                    },
+                                    "cMKUserAssignedIdentity": {
+                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
+                                      "existing": true,
+                                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
+                                      "apiVersion": "2024-11-30",
+                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
+                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
+                                    },
+                                    "storageAccount": {
+                                      "type": "Microsoft.Storage/storageAccounts",
+                                      "apiVersion": "2024-01-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "[parameters('kind')]",
+                                      "sku": {
+                                        "name": "[parameters('skuName')]"
+                                      },
+                                      "identity": "[variables('identity')]",
+                                      "tags": "[parameters('tags')]",
+                                      "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]",
+                                      "dependsOn": [
+                                        "cMKKeyVault",
+                                        "cMKKeyVault::cMKKey"
+                                      ]
+                                    },
+                                    "storageAccount_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "storageAccount_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_roleAssignments": {
+                                      "copy": {
+                                        "name": "storageAccount_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_privateEndpoints": {
+                                      "copy": {
+                                        "name": "storageAccount_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.34.44.8038",
+                                              "templateHash": "12389807800450456797"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "ipConfigurationType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "memberName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "privateIPAddress": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private endpoint IP configurations."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "privateLinkServiceConnectionType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the private link service connection."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupIds": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                                      }
+                                                    },
+                                                    "privateLinkServiceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource id of private link service."
+                                                      }
+                                                    },
+                                                    "requestMessage": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private link service connection."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "customDnsConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                                  }
+                                                },
+                                                "ipAddresses": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/ipConfigurationType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              }
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              }
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS configurations."
+                                              }
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.34.44.8038",
+                                                      "templateHash": "13997305779829540948"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "privateDnsZoneConfigsVar",
+                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                        "input": {
+                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                                          "properties": {
+                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                                          }
+                                                        }
+                                                      }
+                                                    ]
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "metadata": {
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_managementPolicies": {
+                                      "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "rules": {
+                                            "value": "[parameters('managementPolicyRules')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "14529265638306912023"
+                                            },
+                                            "name": "Storage Account Management Policies",
+                                            "description": "This module deploys a Storage Account Management Policy."
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "rules": {
+                                              "type": "array",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules"
+                                                },
+                                                "description": "Required. The Storage Account ManagementPolicies Rules."
+                                              }
+                                            }
+                                          },
+                                          "resources": [
+                                            {
+                                              "type": "Microsoft.Storage/storageAccounts/managementPolicies",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
+                                              "properties": {
+                                                "policy": {
+                                                  "rules": "[parameters('rules')]"
+                                                }
+                                              }
+                                            }
+                                          ],
+                                          "outputs": {
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed management policy."
+                                              },
+                                              "value": "default"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed management policy."
+                                              },
+                                              "value": "default"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed management policy."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount",
+                                        "storageAccount_blobServices"
+                                      ]
+                                    },
+                                    "storageAccount_localUsers": {
+                                      "copy": {
+                                        "name": "storageAccount_localUsers",
+                                        "count": "[length(coalesce(parameters('localUsers'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]"
+                                          },
+                                          "hasSshKey": {
+                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]"
+                                          },
+                                          "hasSshPassword": {
+                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]"
+                                          },
+                                          "permissionScopes": {
+                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]"
+                                          },
+                                          "hasSharedKey": {
+                                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]"
+                                          },
+                                          "homeDirectory": {
+                                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]"
+                                          },
+                                          "sshAuthorizedKeys": {
+                                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "3261275799710495788"
+                                            },
+                                            "name": "Storage Account Local Users",
+                                            "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication."
+                                          },
+                                          "definitions": {
+                                            "sshAuthorizedKeyType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Description used to store the function/usage of the key."
+                                                  }
+                                                },
+                                                "key": {
+                                                  "type": "securestring",
+                                                  "metadata": {
+                                                    "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "permissionScopeType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "permissions": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
+                                                  }
+                                                },
+                                                "resourceName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
+                                                  }
+                                                },
+                                                "service": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The service used by the local user, e.g. blob, file."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the local user used for SFTP Authentication."
+                                              }
+                                            },
+                                            "hasSharedKey": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
+                                              }
+                                            },
+                                            "hasSshKey": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
+                                              }
+                                            },
+                                            "hasSshPassword": {
+                                              "type": "bool",
+                                              "metadata": {
+                                                "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
+                                              }
+                                            },
+                                            "homeDirectory": {
+                                              "type": "string",
+                                              "defaultValue": "",
+                                              "metadata": {
+                                                "description": "Optional. The local user home directory."
+                                              }
+                                            },
+                                            "permissionScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/permissionScopeType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. The permission scopes of the local user."
+                                              }
+                                            },
+                                            "sshAuthorizedKeys": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/sshAuthorizedKeyType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The local user SSH authorized keys for SFTP."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "localUsers": {
+                                              "type": "Microsoft.Storage/storageAccounts/localUsers",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                              "properties": {
+                                                "hasSharedKey": "[parameters('hasSharedKey')]",
+                                                "hasSshKey": "[parameters('hasSshKey')]",
+                                                "hasSshPassword": "[parameters('hasSshPassword')]",
+                                                "homeDirectory": "[parameters('homeDirectory')]",
+                                                "permissionScopes": "[parameters('permissionScopes')]",
+                                                "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed local user."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed local user."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed local user."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_blobServices": {
+                                      "condition": "[not(empty(parameters('blobServices')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "containers": {
+                                            "value": "[tryGet(parameters('blobServices'), 'containers')]"
+                                          },
+                                          "automaticSnapshotPolicyEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
+                                          },
+                                          "changeFeedEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
+                                          },
+                                          "changeFeedRetentionInDays": {
+                                            "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
+                                          },
+                                          "containerDeleteRetentionPolicyEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
+                                          },
+                                          "containerDeleteRetentionPolicyDays": {
+                                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
+                                          },
+                                          "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
+                                          },
+                                          "corsRules": {
+                                            "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
+                                          },
+                                          "defaultServiceVersion": {
+                                            "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
+                                          },
+                                          "deleteRetentionPolicyAllowPermanentDelete": {
+                                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
+                                          },
+                                          "deleteRetentionPolicyEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
+                                          },
+                                          "deleteRetentionPolicyDays": {
+                                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
+                                          },
+                                          "isVersioningEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
+                                          },
+                                          "lastAccessTimeTrackingPolicyEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
+                                          },
+                                          "restorePolicyEnabled": {
+                                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
+                                          },
+                                          "restorePolicyDays": {
+                                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "9925173705553594819"
+                                            },
+                                            "name": "Storage Account blob Services",
+                                            "description": "This module deploys a Storage Account Blob Service."
+                                          },
+                                          "definitions": {
+                                            "corsRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                                  }
+                                                },
+                                                "allowedMethods": {
+                                                  "type": "array",
+                                                  "allowedValues": [
+                                                    "CONNECT",
+                                                    "DELETE",
+                                                    "GET",
+                                                    "HEAD",
+                                                    "MERGE",
+                                                    "OPTIONS",
+                                                    "PATCH",
+                                                    "POST",
+                                                    "PUT",
+                                                    "TRACE"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                                  }
+                                                },
+                                                "allowedOrigins": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                                  }
+                                                },
+                                                "exposedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                                  }
+                                                },
+                                                "maxAgeInSeconds": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for a cors rule."
+                                              }
+                                            },
+                                            "containerType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the Storage Container to deploy."
+                                                  }
+                                                },
+                                                "defaultEncryptionScope": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                                  }
+                                                },
+                                                "denyEncryptionScopeOverride": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Block override of encryption scope from the container default."
+                                                  }
+                                                },
+                                                "enableNfsV3AllSquash": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Enable NFSv3 all squash on blob container."
+                                                  }
+                                                },
+                                                "enableNfsV3RootSquash": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Enable NFSv3 root squash on blob container."
+                                                  }
+                                                },
+                                                "immutableStorageWithVersioningEnabled": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                                  }
+                                                },
+                                                "immutabilityPolicy": {
+                                                  "$ref": "#/definitions/immutabilityPolicyType",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Configure immutability policy."
+                                                  }
+                                                },
+                                                "metadata": {
+                                                  "type": "object",
+                                                  "metadata": {
+                                                    "__bicep_resource_derived_type!": {
+                                                      "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                                    },
+                                                    "description": "Optional. A name-value pair to associate with the container as metadata."
+                                                  },
+                                                  "nullable": true
+                                                },
+                                                "publicAccess": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Blob",
+                                                    "Container",
+                                                    "None"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                                  }
+                                                },
+                                                "roleAssignments": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/roleAssignmentType"
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Array of role assignments to create."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type of a storage container."
+                                              }
+                                            },
+                                            "diagnosticSettingFullType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the diagnostic setting."
+                                                  }
+                                                },
+                                                "logCategoriesAndGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                        }
+                                                      },
+                                                      "categoryGroup": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                  }
+                                                },
+                                                "metricCategories": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                  }
+                                                },
+                                                "logAnalyticsDestinationType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AzureDiagnostics",
+                                                    "Dedicated"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                  }
+                                                },
+                                                "workspaceResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "storageAccountResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "eventHubAuthorizationRuleResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                  }
+                                                },
+                                                "eventHubName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "marketplacePartnerResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            },
+                                            "immutabilityPolicyType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "immutabilityPeriodSinceCreationInDays": {
+                                                  "type": "int",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                                  }
+                                                },
+                                                "allowProtectedAppendWrites": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                                                  }
+                                                },
+                                                "allowProtectedAppendWritesAll": {
+                                                  "type": "bool",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "The type for an immutability policy.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "container/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "automaticSnapshotPolicyEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Automatic Snapshot is enabled if set to true."
+                                              }
+                                            },
+                                            "changeFeedEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
+                                              }
+                                            },
+                                            "changeFeedRetentionInDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 1,
+                                              "maxValue": 146000,
+                                              "metadata": {
+                                                "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
+                                              }
+                                            },
+                                            "containerDeleteRetentionPolicyEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
+                                              }
+                                            },
+                                            "containerDeleteRetentionPolicyDays": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "minValue": 1,
+                                              "maxValue": 365,
+                                              "metadata": {
+                                                "description": "Optional. Indicates the number of days that the deleted item should be retained."
+                                              }
+                                            },
+                                            "containerDeleteRetentionPolicyAllowPermanentDelete": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                              }
+                                            },
+                                            "corsRules": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/corsRuleType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                              }
+                                            },
+                                            "defaultServiceVersion": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
+                                              }
+                                            },
+                                            "deleteRetentionPolicyEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. The blob service properties for blob soft delete."
+                                              }
+                                            },
+                                            "deleteRetentionPolicyDays": {
+                                              "type": "int",
+                                              "defaultValue": 7,
+                                              "minValue": 1,
+                                              "maxValue": 365,
+                                              "metadata": {
+                                                "description": "Optional. Indicates the number of days that the deleted blob should be retained."
+                                              }
+                                            },
+                                            "deleteRetentionPolicyAllowPermanentDelete": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
+                                              }
+                                            },
+                                            "isVersioningEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
+                                              }
+                                            },
+                                            "lastAccessTimeTrackingPolicyEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
+                                              }
+                                            },
+                                            "restorePolicyEnabled": {
+                                              "type": "bool",
+                                              "defaultValue": false,
+                                              "metadata": {
+                                                "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
+                                              }
+                                            },
+                                            "restorePolicyDays": {
+                                              "type": "int",
+                                              "defaultValue": 7,
+                                              "minValue": 1,
+                                              "metadata": {
+                                                "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
+                                              }
+                                            },
+                                            "containers": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/containerType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Blob containers to create."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/diagnosticSettingFullType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "enableReferencedModulesTelemetry": false,
+                                            "name": "default"
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "blobServices": {
+                                              "type": "Microsoft.Storage/storageAccounts/blobServices",
+                                              "apiVersion": "2025-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                                              "properties": {
+                                                "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
+                                                "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
+                                                "containerDeleteRetentionPolicy": {
+                                                  "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
+                                                  "days": "[parameters('containerDeleteRetentionPolicyDays')]",
+                                                  "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
+                                                },
+                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                                "defaultServiceVersion": "[parameters('defaultServiceVersion')]",
+                                                "deleteRetentionPolicy": {
+                                                  "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
+                                                  "days": "[parameters('deleteRetentionPolicyDays')]",
+                                                  "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
+                                                },
+                                                "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
+                                                "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
+                                                "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
+                                              },
+                                              "dependsOn": [
+                                                "storageAccount"
+                                              ]
+                                            },
+                                            "blobServices_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "blobServices_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "blobServices"
+                                              ]
+                                            },
+                                            "blobServices_container": {
+                                              "copy": {
+                                                "name": "blobServices_container",
+                                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "storageAccountName": {
+                                                    "value": "[parameters('storageAccountName')]"
+                                                  },
+                                                  "blobServiceName": {
+                                                    "value": "[variables('name')]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                                  },
+                                                  "defaultEncryptionScope": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
+                                                  },
+                                                  "denyEncryptionScopeOverride": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
+                                                  },
+                                                  "enableNfsV3AllSquash": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
+                                                  },
+                                                  "enableNfsV3RootSquash": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
+                                                  },
+                                                  "immutableStorageWithVersioningEnabled": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
+                                                  },
+                                                  "metadata": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
+                                                  },
+                                                  "publicAccess": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
+                                                  },
+                                                  "roleAssignments": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
+                                                  },
+                                                  "immutabilityPolicy": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]"
+                                                  },
+                                                  "enableTelemetry": {
+                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "5026123498979497429"
+                                                    },
+                                                    "name": "Storage Account Blob Containers",
+                                                    "description": "This module deploys a Storage Account Blob Container."
+                                                  },
+                                                  "definitions": {
+                                                    "immutabilityPolicyType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "immutabilityPeriodSinceCreationInDays": {
+                                                          "type": "int",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                                          }
+                                                        },
+                                                        "allowProtectedAppendWrites": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
+                                                          }
+                                                        },
+                                                        "allowProtectedAppendWritesAll": {
+                                                          "type": "bool",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true,
+                                                        "description": "The type for an immutability policy."
+                                                      }
+                                                    },
+                                                    "roleAssignmentType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                          }
+                                                        },
+                                                        "roleDefinitionIdOrName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                          }
+                                                        },
+                                                        "principalId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                          }
+                                                        },
+                                                        "principalType": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "Device",
+                                                            "ForeignGroup",
+                                                            "Group",
+                                                            "ServicePrincipal",
+                                                            "User"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The principal type of the assigned principal ID."
+                                                          }
+                                                        },
+                                                        "description": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The description of the role assignment."
+                                                          }
+                                                        },
+                                                        "condition": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                          }
+                                                        },
+                                                        "conditionVersion": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "2.0"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Version of the condition."
+                                                          }
+                                                        },
+                                                        "delegatedManagedIdentityResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "description": "An AVM-aligned type for a role assignment.",
+                                                        "__bicep_imported_from!": {
+                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "storageAccountName": {
+                                                      "type": "string",
+                                                      "maxLength": 24,
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "blobServiceName": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The name of the Storage Container to deploy."
+                                                      }
+                                                    },
+                                                    "defaultEncryptionScope": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Default the container to use specified encryption scope for all writes."
+                                                      }
+                                                    },
+                                                    "denyEncryptionScopeOverride": {
+                                                      "type": "bool",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Block override of encryption scope from the container default."
+                                                      }
+                                                    },
+                                                    "enableNfsV3AllSquash": {
+                                                      "type": "bool",
+                                                      "defaultValue": false,
+                                                      "metadata": {
+                                                        "description": "Optional. Enable NFSv3 all squash on blob container."
+                                                      }
+                                                    },
+                                                    "enableNfsV3RootSquash": {
+                                                      "type": "bool",
+                                                      "defaultValue": false,
+                                                      "metadata": {
+                                                        "description": "Optional. Enable NFSv3 root squash on blob container."
+                                                      }
+                                                    },
+                                                    "immutableStorageWithVersioningEnabled": {
+                                                      "type": "bool",
+                                                      "defaultValue": false,
+                                                      "metadata": {
+                                                        "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
+                                                      }
+                                                    },
+                                                    "immutabilityPolicy": {
+                                                      "$ref": "#/definitions/immutabilityPolicyType",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Configure immutability policy."
+                                                      }
+                                                    },
+                                                    "metadata": {
+                                                      "type": "object",
+                                                      "metadata": {
+                                                        "__bicep_resource_derived_type!": {
+                                                          "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
+                                                        },
+                                                        "description": "Optional. A name-value pair to associate with the container as metadata."
+                                                      },
+                                                      "defaultValue": {}
+                                                    },
+                                                    "publicAccess": {
+                                                      "type": "string",
+                                                      "defaultValue": "None",
+                                                      "allowedValues": [
+                                                        "Container",
+                                                        "Blob",
+                                                        "None"
+                                                      ],
+                                                      "metadata": {
+                                                        "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
+                                                      }
+                                                    },
+                                                    "enableTelemetry": {
+                                                      "type": "bool",
+                                                      "defaultValue": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                                      }
+                                                    },
+                                                    "roleAssignments": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/roleAssignmentType"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Array of role assignments to create."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "formattedRoleAssignments",
+                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                                      }
+                                                    ],
+                                                    "builtInRoleNames": {
+                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
+                                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
+                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "storageAccount::blobServices": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts/blobServices",
+                                                      "apiVersion": "2025-01-01",
+                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]"
+                                                    },
+                                                    "avmTelemetry": {
+                                                      "condition": "[parameters('enableTelemetry')]",
+                                                      "type": "Microsoft.Resources/deployments",
+                                                      "apiVersion": "2024-03-01",
+                                                      "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                                      "properties": {
+                                                        "mode": "Incremental",
+                                                        "template": {
+                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                          "contentVersion": "1.0.0.0",
+                                                          "resources": [],
+                                                          "outputs": {
+                                                            "telemetry": {
+                                                              "type": "String",
+                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                            }
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "storageAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts",
+                                                      "apiVersion": "2025-01-01",
+                                                      "name": "[parameters('storageAccountName')]"
+                                                    },
+                                                    "container": {
+                                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
+                                                      "apiVersion": "2025-01-01",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]",
+                                                        "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]",
+                                                        "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
+                                                        "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
+                                                        "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
+                                                        "metadata": "[parameters('metadata')]",
+                                                        "publicAccess": "[parameters('publicAccess')]"
+                                                      }
+                                                    },
+                                                    "container_roleAssignments": {
+                                                      "copy": {
+                                                        "name": "container_roleAssignments",
+                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                                      },
+                                                      "type": "Microsoft.Authorization/roleAssignments",
+                                                      "apiVersion": "2022-04-01",
+                                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
+                                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                                      "properties": {
+                                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                                      },
+                                                      "dependsOn": [
+                                                        "container"
+                                                      ]
+                                                    },
+                                                    "container_immutabilityPolicy": {
+                                                      "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]",
+                                                      "type": "Microsoft.Resources/deployments",
+                                                      "apiVersion": "2022-09-01",
+                                                      "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]",
+                                                      "properties": {
+                                                        "expressionEvaluationOptions": {
+                                                          "scope": "inner"
+                                                        },
+                                                        "mode": "Incremental",
+                                                        "parameters": {
+                                                          "storageAccountName": {
+                                                            "value": "[parameters('storageAccountName')]"
+                                                          },
+                                                          "containerName": {
+                                                            "value": "[parameters('name')]"
+                                                          },
+                                                          "immutabilityPeriodSinceCreationInDays": {
+                                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]"
+                                                          },
+                                                          "allowProtectedAppendWrites": {
+                                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]"
+                                                          },
+                                                          "allowProtectedAppendWritesAll": {
+                                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]"
+                                                          }
+                                                        },
+                                                        "template": {
+                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                          "contentVersion": "1.0.0.0",
+                                                          "metadata": {
+                                                            "_generator": {
+                                                              "name": "bicep",
+                                                              "version": "0.37.4.10188",
+                                                              "templateHash": "10782942397325758470"
+                                                            },
+                                                            "name": "Storage Account Blob Container Immutability Policies",
+                                                            "description": "This module deploys a Storage Account Blob Container Immutability Policy."
+                                                          },
+                                                          "parameters": {
+                                                            "storageAccountName": {
+                                                              "type": "string",
+                                                              "maxLength": 24,
+                                                              "metadata": {
+                                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                                              }
+                                                            },
+                                                            "containerName": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
+                                                              }
+                                                            },
+                                                            "immutabilityPeriodSinceCreationInDays": {
+                                                              "type": "int",
+                                                              "defaultValue": 365,
+                                                              "metadata": {
+                                                                "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
+                                                              }
+                                                            },
+                                                            "allowProtectedAppendWrites": {
+                                                              "type": "bool",
+                                                              "defaultValue": true,
+                                                              "metadata": {
+                                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                                              }
+                                                            },
+                                                            "allowProtectedAppendWritesAll": {
+                                                              "type": "bool",
+                                                              "defaultValue": true,
+                                                              "metadata": {
+                                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
+                                                              }
+                                                            }
+                                                          },
+                                                          "variables": {
+                                                            "name": "default"
+                                                          },
+                                                          "resources": [
+                                                            {
+                                                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
+                                                              "apiVersion": "2025-01-01",
+                                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]",
+                                                              "properties": {
+                                                                "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
+                                                                "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
+                                                                "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
+                                                              }
+                                                            }
+                                                          ],
+                                                          "outputs": {
+                                                            "name": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "The name of the deployed immutability policy."
+                                                              },
+                                                              "value": "[variables('name')]"
+                                                            },
+                                                            "resourceId": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "The resource ID of the deployed immutability policy."
+                                                              },
+                                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]"
+                                                            },
+                                                            "resourceGroupName": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "The resource group of the deployed immutability policy."
+                                                              },
+                                                              "value": "[resourceGroup().name]"
+                                                            }
+                                                          }
+                                                        }
+                                                      },
+                                                      "dependsOn": [
+                                                        "container"
+                                                      ]
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the deployed container."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the deployed container."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group of the deployed container."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "blobServices"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed blob service."
+                                              },
+                                              "value": "[variables('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed blob service."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed blob service."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_fileServices": {
+                                      "condition": "[not(empty(parameters('fileServices')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
+                                          },
+                                          "protocolSettings": {
+                                            "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
+                                          },
+                                          "shareDeleteRetentionPolicy": {
+                                            "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
+                                          },
+                                          "shares": {
+                                            "value": "[tryGet(parameters('fileServices'), 'shares')]"
+                                          },
+                                          "corsRules": {
+                                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "2735186993322606805"
+                                            },
+                                            "name": "Storage Account File Share Services",
+                                            "description": "This module deploys a Storage Account File Share Service."
+                                          },
+                                          "definitions": {
+                                            "corsRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                                  }
+                                                },
+                                                "allowedMethods": {
+                                                  "type": "array",
+                                                  "allowedValues": [
+                                                    "CONNECT",
+                                                    "DELETE",
+                                                    "GET",
+                                                    "HEAD",
+                                                    "MERGE",
+                                                    "OPTIONS",
+                                                    "PATCH",
+                                                    "POST",
+                                                    "PUT",
+                                                    "TRACE"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                                  }
+                                                },
+                                                "allowedOrigins": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                                  }
+                                                },
+                                                "exposedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                                  }
+                                                },
+                                                "maxAgeInSeconds": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for a cors rule."
+                                              }
+                                            },
+                                            "diagnosticSettingFullType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the diagnostic setting."
+                                                  }
+                                                },
+                                                "logCategoriesAndGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                        }
+                                                      },
+                                                      "categoryGroup": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                  }
+                                                },
+                                                "metricCategories": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                  }
+                                                },
+                                                "logAnalyticsDestinationType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AzureDiagnostics",
+                                                    "Dedicated"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                  }
+                                                },
+                                                "workspaceResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "storageAccountResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "eventHubAuthorizationRuleResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                  }
+                                                },
+                                                "eventHubName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "marketplacePartnerResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "defaultValue": "default",
+                                              "metadata": {
+                                                "description": "Optional. The name of the file service."
+                                              }
+                                            },
+                                            "protocolSettings": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
+                                                },
+                                                "description": "Optional. Protocol settings for file service."
+                                              },
+                                              "defaultValue": {}
+                                            },
+                                            "shareDeleteRetentionPolicy": {
+                                              "type": "object",
+                                              "metadata": {
+                                                "__bicep_resource_derived_type!": {
+                                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
+                                                },
+                                                "description": "Optional. The service properties for soft delete."
+                                              },
+                                              "defaultValue": {
+                                                "enabled": true,
+                                                "days": 7
+                                              }
+                                            },
+                                            "corsRules": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/corsRuleType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/diagnosticSettingFullType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            },
+                                            "shares": {
+                                              "type": "array",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. File shares to create."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "enableReferencedModulesTelemetry": false
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "fileServices": {
+                                              "type": "Microsoft.Storage/storageAccounts/fileServices",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                              "properties": {
+                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
+                                                "protocolSettings": "[parameters('protocolSettings')]",
+                                                "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
+                                              }
+                                            },
+                                            "fileServices_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "fileServices_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "fileServices"
+                                              ]
+                                            },
+                                            "fileServices_shares": {
+                                              "copy": {
+                                                "name": "fileServices_shares",
+                                                "count": "[length(coalesce(parameters('shares'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "storageAccountName": {
+                                                    "value": "[parameters('storageAccountName')]"
+                                                  },
+                                                  "fileServicesName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
+                                                  },
+                                                  "accessTier": {
+                                                    "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]"
+                                                  },
+                                                  "enabledProtocols": {
+                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
+                                                  },
+                                                  "rootSquash": {
+                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
+                                                  },
+                                                  "shareQuota": {
+                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
+                                                  },
+                                                  "roleAssignments": {
+                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
+                                                  },
+                                                  "enableTelemetry": {
+                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "15881640847294537074"
+                                                    },
+                                                    "name": "Storage Account File Shares",
+                                                    "description": "This module deploys a Storage Account File Share."
+                                                  },
+                                                  "definitions": {
+                                                    "roleAssignmentType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                          }
+                                                        },
+                                                        "roleDefinitionIdOrName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                          }
+                                                        },
+                                                        "principalId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                          }
+                                                        },
+                                                        "principalType": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "Device",
+                                                            "ForeignGroup",
+                                                            "Group",
+                                                            "ServicePrincipal",
+                                                            "User"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The principal type of the assigned principal ID."
+                                                          }
+                                                        },
+                                                        "description": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The description of the role assignment."
+                                                          }
+                                                        },
+                                                        "condition": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                          }
+                                                        },
+                                                        "conditionVersion": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "2.0"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Version of the condition."
+                                                          }
+                                                        },
+                                                        "delegatedManagedIdentityResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "description": "An AVM-aligned type for a role assignment.",
+                                                        "__bicep_imported_from!": {
+                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "storageAccountName": {
+                                                      "type": "string",
+                                                      "maxLength": 24,
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "fileServicesName": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The name of the file share to create."
+                                                      }
+                                                    },
+                                                    "accessTier": {
+                                                      "type": "string",
+                                                      "defaultValue": "TransactionOptimized",
+                                                      "allowedValues": [
+                                                        "Premium",
+                                                        "Hot",
+                                                        "Cool",
+                                                        "TransactionOptimized"
+                                                      ],
+                                                      "metadata": {
+                                                        "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
+                                                      }
+                                                    },
+                                                    "shareQuota": {
+                                                      "type": "int",
+                                                      "defaultValue": 5120,
+                                                      "metadata": {
+                                                        "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
+                                                      }
+                                                    },
+                                                    "enabledProtocols": {
+                                                      "type": "string",
+                                                      "defaultValue": "SMB",
+                                                      "allowedValues": [
+                                                        "NFS",
+                                                        "SMB"
+                                                      ],
+                                                      "metadata": {
+                                                        "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
+                                                      }
+                                                    },
+                                                    "rootSquash": {
+                                                      "type": "string",
+                                                      "defaultValue": "NoRootSquash",
+                                                      "allowedValues": [
+                                                        "AllSquash",
+                                                        "NoRootSquash",
+                                                        "RootSquash"
+                                                      ],
+                                                      "metadata": {
+                                                        "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
+                                                      }
+                                                    },
+                                                    "enableTelemetry": {
+                                                      "type": "bool",
+                                                      "defaultValue": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                                      }
+                                                    },
+                                                    "roleAssignments": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/roleAssignmentType"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Array of role assignments to create."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "formattedRoleAssignments",
+                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                                      }
+                                                    ],
+                                                    "builtInRoleNames": {
+                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
+                                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
+                                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
+                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "storageAccount::fileService": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts/fileServices",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]"
+                                                    },
+                                                    "avmTelemetry": {
+                                                      "condition": "[parameters('enableTelemetry')]",
+                                                      "type": "Microsoft.Resources/deployments",
+                                                      "apiVersion": "2024-03-01",
+                                                      "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                                      "properties": {
+                                                        "mode": "Incremental",
+                                                        "template": {
+                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                          "contentVersion": "1.0.0.0",
+                                                          "resources": [],
+                                                          "outputs": {
+                                                            "telemetry": {
+                                                              "type": "String",
+                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                            }
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "storageAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[parameters('storageAccountName')]"
+                                                    },
+                                                    "fileShare": {
+                                                      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "accessTier": "[parameters('accessTier')]",
+                                                        "shareQuota": "[parameters('shareQuota')]",
+                                                        "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
+                                                        "enabledProtocols": "[parameters('enabledProtocols')]"
+                                                      }
+                                                    },
+                                                    "fileShare_roleAssignments": {
+                                                      "copy": {
+                                                        "name": "fileShare_roleAssignments",
+                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                                      },
+                                                      "type": "Microsoft.Resources/deployments",
+                                                      "apiVersion": "2022-09-01",
+                                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
+                                                      "properties": {
+                                                        "expressionEvaluationOptions": {
+                                                          "scope": "inner"
+                                                        },
+                                                        "mode": "Incremental",
+                                                        "parameters": {
+                                                          "scope": {
+                                                            "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]"
+                                                          },
+                                                          "name": {
+                                                            "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]"
+                                                          },
+                                                          "roleDefinitionId": {
+                                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                                          },
+                                                          "principalId": {
+                                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                                          },
+                                                          "principalType": {
+                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
+                                                          },
+                                                          "condition": {
+                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]"
+                                                          },
+                                                          "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]",
+                                                          "delegatedManagedIdentityResourceId": {
+                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                                          },
+                                                          "description": {
+                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
+                                                          }
+                                                        },
+                                                        "template": {
+                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                          "contentVersion": "1.0.0.0",
+                                                          "parameters": {
+                                                            "scope": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "Required. The scope to deploy the role assignment to."
+                                                              }
+                                                            },
+                                                            "name": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "Required. The name of the role assignment."
+                                                              }
+                                                            },
+                                                            "roleDefinitionId": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "Required. The role definition Id to assign."
+                                                              }
+                                                            },
+                                                            "principalId": {
+                                                              "type": "string",
+                                                              "metadata": {
+                                                                "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                              }
+                                                            },
+                                                            "principalType": {
+                                                              "type": "string",
+                                                              "allowedValues": [
+                                                                "Device",
+                                                                "ForeignGroup",
+                                                                "Group",
+                                                                "ServicePrincipal",
+                                                                "User",
+                                                                ""
+                                                              ],
+                                                              "defaultValue": "",
+                                                              "metadata": {
+                                                                "description": "Optional. The principal type of the assigned principal ID."
+                                                              }
+                                                            },
+                                                            "description": {
+                                                              "type": "string",
+                                                              "defaultValue": "",
+                                                              "metadata": {
+                                                                "description": "Optional. The description of the role assignment."
+                                                              }
+                                                            },
+                                                            "condition": {
+                                                              "type": "string",
+                                                              "defaultValue": "",
+                                                              "metadata": {
+                                                                "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
+                                                              }
+                                                            },
+                                                            "conditionVersion": {
+                                                              "type": "string",
+                                                              "allowedValues": [
+                                                                "2.0"
+                                                              ],
+                                                              "defaultValue": "2.0",
+                                                              "metadata": {
+                                                                "description": "Optional. Version of the condition."
+                                                              }
+                                                            },
+                                                            "delegatedManagedIdentityResourceId": {
+                                                              "type": "string",
+                                                              "defaultValue": "",
+                                                              "metadata": {
+                                                                "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                              }
+                                                            }
+                                                          },
+                                                          "resources": [
+                                                            {
+                                                              "type": "Microsoft.Authorization/roleAssignments",
+                                                              "apiVersion": "2022-04-01",
+                                                              "scope": "[parameters('scope')]",
+                                                              "name": "[parameters('name')]",
+                                                              "properties": {
+                                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                                "principalId": "[parameters('principalId')]",
+                                                                "description": "[parameters('description')]",
+                                                                "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
+                                                                "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
+                                                                "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
+                                                                "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
+                                                              }
+                                                            }
+                                                          ]
+                                                        }
+                                                      },
+                                                      "dependsOn": [
+                                                        "fileShare"
+                                                      ]
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the deployed file share."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the deployed file share."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group of the deployed file share."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "fileServices",
+                                                "storageAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed file share service."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed file share service."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed file share service."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_queueServices": {
+                                      "condition": "[not(empty(parameters('queueServices')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
+                                          },
+                                          "queues": {
+                                            "value": "[tryGet(parameters('queueServices'), 'queues')]"
+                                          },
+                                          "corsRules": {
+                                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "1100093319443502715"
+                                            },
+                                            "name": "Storage Account Queue Services",
+                                            "description": "This module deploys a Storage Account Queue Service."
+                                          },
+                                          "definitions": {
+                                            "corsRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                                  }
+                                                },
+                                                "allowedMethods": {
+                                                  "type": "array",
+                                                  "allowedValues": [
+                                                    "CONNECT",
+                                                    "DELETE",
+                                                    "GET",
+                                                    "HEAD",
+                                                    "MERGE",
+                                                    "OPTIONS",
+                                                    "PATCH",
+                                                    "POST",
+                                                    "PUT",
+                                                    "TRACE"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                                  }
+                                                },
+                                                "allowedOrigins": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                                  }
+                                                },
+                                                "exposedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                                  }
+                                                },
+                                                "maxAgeInSeconds": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for a cors rule."
+                                              }
+                                            },
+                                            "diagnosticSettingFullType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the diagnostic setting."
+                                                  }
+                                                },
+                                                "logCategoriesAndGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                        }
+                                                      },
+                                                      "categoryGroup": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                  }
+                                                },
+                                                "metricCategories": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                  }
+                                                },
+                                                "logAnalyticsDestinationType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AzureDiagnostics",
+                                                    "Dedicated"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                  }
+                                                },
+                                                "workspaceResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "storageAccountResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "eventHubAuthorizationRuleResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                  }
+                                                },
+                                                "eventHubName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "marketplacePartnerResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "queues": {
+                                              "type": "array",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Queues to create."
+                                              }
+                                            },
+                                            "corsRules": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/corsRuleType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/diagnosticSettingFullType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "name": "default"
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "queueServices": {
+                                              "type": "Microsoft.Storage/storageAccounts/queueServices",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                                              "properties": {
+                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                                              }
+                                            },
+                                            "queueServices_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "queueServices_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "queueServices"
+                                              ]
+                                            },
+                                            "queueServices_queues": {
+                                              "copy": {
+                                                "name": "queueServices_queues",
+                                                "count": "[length(coalesce(parameters('queues'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "storageAccountName": {
+                                                    "value": "[parameters('storageAccountName')]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
+                                                  },
+                                                  "metadata": {
+                                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
+                                                  },
+                                                  "roleAssignments": {
+                                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "17963799770990303971"
+                                                    },
+                                                    "name": "Storage Account Queues",
+                                                    "description": "This module deploys a Storage Account Queue."
+                                                  },
+                                                  "definitions": {
+                                                    "roleAssignmentType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                          }
+                                                        },
+                                                        "roleDefinitionIdOrName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                          }
+                                                        },
+                                                        "principalId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                          }
+                                                        },
+                                                        "principalType": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "Device",
+                                                            "ForeignGroup",
+                                                            "Group",
+                                                            "ServicePrincipal",
+                                                            "User"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The principal type of the assigned principal ID."
+                                                          }
+                                                        },
+                                                        "description": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The description of the role assignment."
+                                                          }
+                                                        },
+                                                        "condition": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                          }
+                                                        },
+                                                        "conditionVersion": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "2.0"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Version of the condition."
+                                                          }
+                                                        },
+                                                        "delegatedManagedIdentityResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "description": "An AVM-aligned type for a role assignment.",
+                                                        "__bicep_imported_from!": {
+                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "storageAccountName": {
+                                                      "type": "string",
+                                                      "maxLength": 24,
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The name of the storage queue to deploy."
+                                                      }
+                                                    },
+                                                    "metadata": {
+                                                      "type": "object",
+                                                      "metadata": {
+                                                        "__bicep_resource_derived_type!": {
+                                                          "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
+                                                        },
+                                                        "description": "Optional. A name-value pair that represents queue metadata."
+                                                      },
+                                                      "defaultValue": {}
+                                                    },
+                                                    "roleAssignments": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/roleAssignmentType"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Array of role assignments to create."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "formattedRoleAssignments",
+                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                                      }
+                                                    ],
+                                                    "builtInRoleNames": {
+                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
+                                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
+                                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
+                                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
+                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "storageAccount::queueServices": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts/queueServices",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                                    },
+                                                    "storageAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[parameters('storageAccountName')]"
+                                                    },
+                                                    "queue": {
+                                                      "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                                      "properties": {
+                                                        "metadata": "[parameters('metadata')]"
+                                                      }
+                                                    },
+                                                    "queue_roleAssignments": {
+                                                      "copy": {
+                                                        "name": "queue_roleAssignments",
+                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                                      },
+                                                      "type": "Microsoft.Authorization/roleAssignments",
+                                                      "apiVersion": "2022-04-01",
+                                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                                      "properties": {
+                                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                                      },
+                                                      "dependsOn": [
+                                                        "queue"
+                                                      ]
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the deployed queue."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the deployed queue."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group of the deployed queue."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed file share service."
+                                              },
+                                              "value": "[variables('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed file share service."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed file share service."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "storageAccount_tableServices": {
+                                      "condition": "[not(empty(parameters('tableServices')))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "storageAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "diagnosticSettings": {
+                                            "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
+                                          },
+                                          "tables": {
+                                            "value": "[tryGet(parameters('tableServices'), 'tables')]"
+                                          },
+                                          "corsRules": {
+                                            "value": "[tryGet(parameters('tableServices'), 'corsRules')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "13069389074590786512"
+                                            },
+                                            "name": "Storage Account Table Services",
+                                            "description": "This module deploys a Storage Account Table Service."
+                                          },
+                                          "definitions": {
+                                            "corsRuleType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "allowedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
+                                                  }
+                                                },
+                                                "allowedMethods": {
+                                                  "type": "array",
+                                                  "allowedValues": [
+                                                    "CONNECT",
+                                                    "DELETE",
+                                                    "GET",
+                                                    "HEAD",
+                                                    "MERGE",
+                                                    "OPTIONS",
+                                                    "PATCH",
+                                                    "POST",
+                                                    "PUT",
+                                                    "TRACE"
+                                                  ],
+                                                  "metadata": {
+                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
+                                                  }
+                                                },
+                                                "allowedOrigins": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
+                                                  }
+                                                },
+                                                "exposedHeaders": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of response headers to expose to CORS clients."
+                                                  }
+                                                },
+                                                "maxAgeInSeconds": {
+                                                  "type": "int",
+                                                  "metadata": {
+                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for a cors rule."
+                                              }
+                                            },
+                                            "diagnosticSettingFullType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the diagnostic setting."
+                                                  }
+                                                },
+                                                "logCategoriesAndGroups": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                        }
+                                                      },
+                                                      "categoryGroup": {
+                                                        "type": "string",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                                  }
+                                                },
+                                                "metricCategories": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "object",
+                                                    "properties": {
+                                                      "category": {
+                                                        "type": "string",
+                                                        "metadata": {
+                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                        }
+                                                      },
+                                                      "enabled": {
+                                                        "type": "bool",
+                                                        "nullable": true,
+                                                        "metadata": {
+                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                                  }
+                                                },
+                                                "logAnalyticsDestinationType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "AzureDiagnostics",
+                                                    "Dedicated"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                                  }
+                                                },
+                                                "workspaceResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "storageAccountResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "eventHubAuthorizationRuleResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                                  }
+                                                },
+                                                "eventHubName": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                                  }
+                                                },
+                                                "marketplacePartnerResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "storageAccountName": {
+                                              "type": "string",
+                                              "maxLength": 24,
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "tables": {
+                                              "type": "array",
+                                              "defaultValue": [],
+                                              "metadata": {
+                                                "description": "Optional. tables to create."
+                                              }
+                                            },
+                                            "corsRules": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/corsRuleType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
+                                              }
+                                            },
+                                            "diagnosticSettings": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/diagnosticSettingFullType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The diagnostic settings of the service."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "name": "default"
+                                          },
+                                          "resources": {
+                                            "storageAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.Storage/storageAccounts",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[parameters('storageAccountName')]"
+                                            },
+                                            "tableServices": {
+                                              "type": "Microsoft.Storage/storageAccounts/tableServices",
+                                              "apiVersion": "2024-01-01",
+                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
+                                              "properties": {
+                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
+                                              }
+                                            },
+                                            "tableServices_diagnosticSettings": {
+                                              "copy": {
+                                                "name": "tableServices_diagnosticSettings",
+                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Insights/diagnosticSettings",
+                                              "apiVersion": "2021-05-01-preview",
+                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "metrics",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                                    "input": {
+                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                                      "timeGrain": null
+                                                    }
+                                                  },
+                                                  {
+                                                    "name": "logs",
+                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                                    "input": {
+                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                                    }
+                                                  }
+                                                ],
+                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                              },
+                                              "dependsOn": [
+                                                "tableServices"
+                                              ]
+                                            },
+                                            "tableServices_tables": {
+                                              "copy": {
+                                                "name": "tableServices_tables",
+                                                "count": "[length(parameters('tables'))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[parameters('tables')[copyIndex()].name]"
+                                                  },
+                                                  "storageAccountName": {
+                                                    "value": "[parameters('storageAccountName')]"
+                                                  },
+                                                  "roleAssignments": {
+                                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "10905926757212375091"
+                                                    },
+                                                    "name": "Storage Account Table",
+                                                    "description": "This module deploys a Storage Account Table."
+                                                  },
+                                                  "definitions": {
+                                                    "roleAssignmentType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                          }
+                                                        },
+                                                        "roleDefinitionIdOrName": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                          }
+                                                        },
+                                                        "principalId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                          }
+                                                        },
+                                                        "principalType": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "Device",
+                                                            "ForeignGroup",
+                                                            "Group",
+                                                            "ServicePrincipal",
+                                                            "User"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The principal type of the assigned principal ID."
+                                                          }
+                                                        },
+                                                        "description": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The description of the role assignment."
+                                                          }
+                                                        },
+                                                        "condition": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                          }
+                                                        },
+                                                        "conditionVersion": {
+                                                          "type": "string",
+                                                          "allowedValues": [
+                                                            "2.0"
+                                                          ],
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. Version of the condition."
+                                                          }
+                                                        },
+                                                        "delegatedManagedIdentityResourceId": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "description": "An AVM-aligned type for a role assignment.",
+                                                        "__bicep_imported_from!": {
+                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "storageAccountName": {
+                                                      "type": "string",
+                                                      "maxLength": 24,
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "roleAssignments": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/roleAssignmentType"
+                                                      },
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Array of role assignments to create."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. Name of the table."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "formattedRoleAssignments",
+                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                                      }
+                                                    ],
+                                                    "builtInRoleNames": {
+                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
+                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
+                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
+                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
+                                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
+                                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
+                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "storageAccount::tableServices": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts/tableServices",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
+                                                    },
+                                                    "storageAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Storage/storageAccounts",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[parameters('storageAccountName')]"
+                                                    },
+                                                    "table": {
+                                                      "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
+                                                      "apiVersion": "2024-01-01",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                                    },
+                                                    "table_roleAssignments": {
+                                                      "copy": {
+                                                        "name": "table_roleAssignments",
+                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                                      },
+                                                      "type": "Microsoft.Authorization/roleAssignments",
+                                                      "apiVersion": "2022-04-01",
+                                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
+                                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                                      "properties": {
+                                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                                      },
+                                                      "dependsOn": [
+                                                        "table"
+                                                      ]
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the deployed file share service."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the deployed file share service."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group of the deployed file share service."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the deployed table service."
+                                              },
+                                              "value": "[variables('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the deployed table service."
+                                              },
+                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group of the deployed table service."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    },
+                                    "secretsExport": {
+                                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
+                                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
+                                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "keyVaultName": {
+                                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
+                                          },
+                                          "secretsToSet": {
+                                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "9368972709899985618"
+                                            }
+                                          },
+                                          "definitions": {
+                                            "secretSetOutputType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "secretResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The resourceId of the exported secret."
+                                                  }
+                                                },
+                                                "secretUri": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The secret URI of the exported secret."
+                                                  }
+                                                },
+                                                "secretUriWithVersion": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "The secret URI with version of the exported secret."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                }
+                                              }
+                                            },
+                                            "secretToSetType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the secret to set."
+                                                  }
+                                                },
+                                                "value": {
+                                                  "type": "securestring",
+                                                  "metadata": {
+                                                    "description": "Required. The value of the secret to set."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "keyVaultName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The name of the Key Vault to set the ecrets in."
+                                              }
+                                            },
+                                            "secretsToSet": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/secretToSetType"
+                                              },
+                                              "metadata": {
+                                                "description": "Required. The secrets to set in the Key Vault."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "keyVault": {
+                                              "existing": true,
+                                              "type": "Microsoft.KeyVault/vaults",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[parameters('keyVaultName')]"
+                                            },
+                                            "secrets": {
+                                              "copy": {
+                                                "name": "secrets",
+                                                "count": "[length(parameters('secretsToSet'))]"
+                                              },
+                                              "type": "Microsoft.KeyVault/vaults/secrets",
+                                              "apiVersion": "2024-11-01",
+                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
+                                              "properties": {
+                                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "secretsSet": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/secretSetOutputType"
+                                              },
+                                              "metadata": {
+                                                "description": "The references to the secrets exported to the provided Key Vault."
+                                              },
+                                              "copy": {
+                                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
+                                                "input": {
+                                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
+                                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
+                                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
+                                                }
+                                              }
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "storageAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the deployed storage account."
+                                      },
+                                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+                                    },
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the deployed storage account."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource group of the deployed storage account."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "primaryBlobEndpoint": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The primary blob endpoint reference if blob services are deployed."
+                                      },
+                                      "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('storageAccount', '2024-01-01', 'full').location]"
+                                    },
+                                    "serviceEndpoints": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
+                                      },
+                                      "value": "[reference('storageAccount').primaryEndpoints]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the Storage Account."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    },
+                                    "exportedSecrets": {
+                                      "$ref": "#/definitions/secretsOutputType",
+                                      "metadata": {
+                                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
+                                      },
+                                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
+                                    },
+                                    "primaryAccessKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary access key of the storage account."
+                                      },
+                                      "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]"
+                                    },
+                                    "secondaryAccessKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondary access key of the storage account."
+                                      },
+                                      "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]"
+                                    },
+                                    "primaryConnectionString": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary connection string of the storage account."
+                                      },
+                                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]"
+                                    },
+                                    "secondaryConnectionString": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondary connection string of the storage account."
+                                      },
+                                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the Storage Account."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.name.value, variables('existingName'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the Storage Account."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Storage/storageAccounts', variables('existingName')))]"
+                            },
+                            "subscriptionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Subscription ID of the Storage Account."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource Group Name of the Storage Account."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "aiSearch",
+                        "foundryAccount"
+                      ]
+                    },
+                    "cosmosDb": {
+                      "condition": "[parameters('includeAssociatedResources')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('module.cosmosDb.{0}', variables('resourcesName')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "existingResourceId": {
+                            "value": "[tryGet(parameters('cosmosDbConfiguration'), 'existingResourceId')]"
+                          },
+                          "name": {
+                            "value": "[take(if(not(empty(tryGet(parameters('cosmosDbConfiguration'), 'name'))), parameters('cosmosDbConfiguration').name, format('cos{0}', variables('resourcesName'))), 44)]"
+                          },
+                          "location": {
+                            "value": "[parameters('location')]"
+                          },
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "enableTelemetry": {
+                            "value": "[parameters('enableTelemetry')]"
+                          },
+                          "privateEndpointSubnetResourceId": {
+                            "value": "[parameters('privateEndpointSubnetResourceId')]"
+                          },
+                          "privateDnsZoneResourceId": {
+                            "value": "[tryGet(parameters('cosmosDbConfiguration'), 'privateDnsZoneResourceId')]"
+                          },
+                          "roleAssignments": {
+                            "value": "[tryGet(parameters('cosmosDbConfiguration'), 'roleAssignments')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "12826689517691444097"
+                            }
+                          },
+                          "definitions": {
+                            "roleAssignmentType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                  }
+                                },
+                                "roleDefinitionIdOrName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                  }
+                                },
+                                "principalId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                  }
+                                },
+                                "principalType": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "Device",
+                                    "ForeignGroup",
+                                    "Group",
+                                    "ServicePrincipal",
+                                    "User"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The principal type of the assigned principal ID."
+                                  }
+                                },
+                                "description": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The description of the role assignment."
+                                  }
+                                },
+                                "condition": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                  }
+                                },
+                                "conditionVersion": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "2.0"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Version of the condition."
+                                  }
+                                },
+                                "delegatedManagedIdentityResourceId": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a role assignment.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "functions": [
+                            {
+                              "namespace": "__bicep",
+                              "members": {
+                                "getResourceGroupName": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Group Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceName": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    },
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Resource Name from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getResourceParts": {
+                                  "parameters": [
+                                    {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "name": "resourceId"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "array",
+                                    "items": {
+                                      "type": "string"
+                                    },
+                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
+                                  },
+                                  "metadata": {
+                                    "description": "Splits Resource ID into its components.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                },
+                                "getSubscriptionId": {
+                                  "parameters": [
+                                    {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "name": "parts"
+                                    }
+                                  ],
+                                  "output": {
+                                    "type": "string",
+                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
+                                  },
+                                  "metadata": {
+                                    "description": "Extracts the Subscription ID from a Resource ID.",
+                                    "__bicep_imported_from!": {
+                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          ],
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "maxLength": 44,
+                              "metadata": {
+                                "description": "Required. The name of the Cosmos DB."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. The location for the Cosmos DB."
+                              }
+                            },
+                            "existingResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The full resource ID of an existing Cosmos DB to use instead of creating a new one."
+                              }
+                            },
+                            "privateEndpointSubnetResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints."
+                              }
+                            },
+                            "privateDnsZoneResourceId": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The resource ID of the private DNS zone for the Cosmos DB to establish private endpoints."
+                              }
+                            },
+                            "roleAssignments": {
+                              "type": "array",
+                              "items": {
+                                "$ref": "#/definitions/roleAssignmentType"
+                              },
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Specifies the role assignments for the Cosmos DB."
+                              }
+                            },
+                            "enableTelemetry": {
+                              "type": "bool",
+                              "defaultValue": true,
+                              "metadata": {
+                                "description": "Optional. Enable/Disable usage telemetry for module."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Specifies the resource tags for all the resources."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
+                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
+                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
+                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
+                            "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
+                          },
+                          "resources": {
+                            "existingCosmosDb": {
+                              "condition": "[not(empty(parameters('existingResourceId')))]",
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "subscriptionId": "[variables('existingSubscriptionId')]",
+                              "resourceGroup": "[variables('existingResourceGroupName')]",
+                              "name": "[variables('existingName')]"
+                            },
+                            "cosmosDb": {
+                              "condition": "[empty(parameters('existingResourceId'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('avm.res.document-db.database-account.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[parameters('name')]"
+                                  },
+                                  "enableTelemetry": {
+                                    "value": "[parameters('enableTelemetry')]"
+                                  },
+                                  "automaticFailover": {
+                                    "value": true
+                                  },
+                                  "disableKeyBasedMetadataWriteAccess": {
+                                    "value": true
+                                  },
+                                  "disableLocalAuthentication": {
+                                    "value": true
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "minimumTlsVersion": {
+                                    "value": "Tls12"
+                                  },
+                                  "defaultConsistencyLevel": {
+                                    "value": "Session"
+                                  },
+                                  "networkRestrictions": {
+                                    "value": {
+                                      "networkAclBypass": "AzureServices",
+                                      "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), 'Disabled', 'Enabled')]"
+                                    }
+                                  },
+                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'Sql', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
+                                  "roleAssignments": {
+                                    "value": "[parameters('roleAssignments')]"
+                                  },
+                                  "tags": {
+                                    "value": "[parameters('tags')]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "languageVersion": "2.0",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.37.4.10188",
+                                      "templateHash": "17715929342484596741"
+                                    },
+                                    "name": "Azure Cosmos DB account",
+                                    "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed."
+                                  },
+                                  "definitions": {
+                                    "privateEndpointOutputType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The name of the private endpoint."
+                                          }
+                                        },
+                                        "resourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "The resource ID of the private endpoint."
+                                          }
+                                        },
+                                        "groupId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "The group ID for the private endpoint group."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "fqdn": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address."
+                                                }
+                                              },
+                                              "ipAddresses": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "metadata": {
+                                                  "description": "A list of private IP addresses for the private endpoint."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "The custom DNS configurations of the private endpoint."
+                                          }
+                                        },
+                                        "networkInterfaceResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "The IDs of the network interfaces associated with the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the private endpoint output."
+                                      }
+                                    },
+                                    "failoverLocationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "failoverPriority": {
+                                          "type": "int",
+                                          "metadata": {
+                                            "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
+                                          }
+                                        },
+                                        "isZoneRedundant": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true."
+                                          }
+                                        },
+                                        "locationName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the region."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the failover location."
+                                      }
+                                    },
+                                    "dataPlaneRoleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The unique name of the role assignment."
+                                          }
+                                        },
+                                        "roleDefinitionId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment."
+                                      }
+                                    },
+                                    "dataPlaneRoleDefinitionType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The unique identifier of the role-based access control definition."
+                                          }
+                                        },
+                                        "roleName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account."
+                                          }
+                                        },
+                                        "dataActions": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An array of data actions that are allowed."
+                                          }
+                                        },
+                                        "assignableScopes": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope."
+                                          }
+                                        },
+                                        "assignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/sqlRoleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. An array of role-based access control assignments to be created for the definition."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition."
+                                      }
+                                    },
+                                    "sqlDatabaseType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Name of the database ."
+                                          }
+                                        },
+                                        "throughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400."
+                                          }
+                                        },
+                                        "autoscaleSettingsMaxThroughput": {
+                                          "type": "int",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                          }
+                                        },
+                                        "containers": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of the container."
+                                                }
+                                              },
+                                              "paths": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "string"
+                                                },
+                                                "minLength": 1,
+                                                "maxLength": 3,
+                                                "metadata": {
+                                                  "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                                }
+                                              },
+                                              "analyticalStorageTtl": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                                }
+                                              },
+                                              "autoscaleSettingsMaxThroughput": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "maxValue": 1000000,
+                                                "metadata": {
+                                                  "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
+                                                }
+                                              },
+                                              "conflictResolutionPolicy": {
+                                                "type": "object",
+                                                "properties": {
+                                                  "conflictResolutionPath": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
+                                                    }
+                                                  },
+                                                  "conflictResolutionProcedure": {
+                                                    "type": "string",
+                                                    "nullable": true,
+                                                    "metadata": {
+                                                      "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
+                                                    }
+                                                  },
+                                                  "mode": {
+                                                    "type": "string",
+                                                    "allowedValues": [
+                                                      "Custom",
+                                                      "LastWriterWins"
+                                                    ],
+                                                    "metadata": {
+                                                      "description": "Required. Indicates the conflict resolution mode."
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                                }
+                                              },
+                                              "defaultTtl": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "minValue": -1,
+                                                "maxValue": 2147483647,
+                                                "metadata": {
+                                                  "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                                }
+                                              },
+                                              "indexingPolicy": {
+                                                "type": "object",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Indexing policy of the container."
+                                                }
+                                              },
+                                              "kind": {
+                                                "type": "string",
+                                                "allowedValues": [
+                                                  "Hash",
+                                                  "MultiHash"
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                                }
+                                              },
+                                              "version": {
+                                                "type": "int",
+                                                "allowedValues": [
+                                                  1,
+                                                  2
+                                                ],
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                                }
+                                              },
+                                              "throughput": {
+                                                "type": "int",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
+                                                }
+                                              },
+                                              "uniqueKeyPolicyKeys": {
+                                                "type": "array",
+                                                "items": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "paths": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "metadata": {
+                                                        "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
+                                                      }
+                                                    }
+                                                  }
+                                                },
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Set of containers to deploy in the database."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for an Azure Cosmos DB for NoSQL database."
+                                      }
+                                    },
+                                    "networkRestrictionType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "ipRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`."
+                                          }
+                                        },
+                                        "networkAclBypass": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureServices",
+                                            "None"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"."
+                                          }
+                                        },
+                                        "publicNetworkAccess": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Disabled",
+                                            "Enabled"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"."
+                                          }
+                                        },
+                                        "virtualNetworkRules": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "subnetResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Resource ID of a subnet."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. List of virtual network access control list (ACL) rules configured for the account."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_export!": true,
+                                        "description": "The type for the network restriction."
+                                      }
+                                    },
+                                    "_1.privateEndpointCustomDnsConfigType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "fqdn": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                          }
+                                        },
+                                        "ipAddresses": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "metadata": {
+                                            "description": "Required. A list of private IP addresses of the private endpoint."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointIpConfigurationType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The name of the resource that is unique within a resource group."
+                                          }
+                                        },
+                                        "properties": {
+                                          "type": "object",
+                                          "properties": {
+                                            "groupId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "memberName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
+                                              }
+                                            },
+                                            "privateIPAddress": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. Properties of private endpoint IP configurations."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the Private DNS Zone Group."
+                                          }
+                                        },
+                                        "privateDnsZoneGroupConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "name": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. The name of the private DNS Zone Group config."
+                                                }
+                                              },
+                                              "privateDnsZoneResourceId": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. The resource id of the private DNS zone."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "metadata": {
+                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "diagnosticSettingFullType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the diagnostic setting."
+                                          }
+                                        },
+                                        "logCategoriesAndGroups": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
+                                                }
+                                              },
+                                              "categoryGroup": {
+                                                "type": "string",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
+                                          }
+                                        },
+                                        "metricCategories": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "object",
+                                            "properties": {
+                                              "category": {
+                                                "type": "string",
+                                                "metadata": {
+                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                                }
+                                              },
+                                              "enabled": {
+                                                "type": "bool",
+                                                "nullable": true,
+                                                "metadata": {
+                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                                          }
+                                        },
+                                        "logAnalyticsDestinationType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "AzureDiagnostics",
+                                            "Dedicated"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                                          }
+                                        },
+                                        "workspaceResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "storageAccountResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "eventHubAuthorizationRuleResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                                          }
+                                        },
+                                        "eventHubName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                                          }
+                                        },
+                                        "marketplacePartnerResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "lockType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the name of lock."
+                                          }
+                                        },
+                                        "kind": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "CanNotDelete",
+                                            "None",
+                                            "ReadOnly"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "notes": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the notes of the lock."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a lock.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "managedIdentityAllType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "systemAssigned": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enables system assigned managed identity on the resource."
+                                          }
+                                        },
+                                        "userAssignedResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "privateEndpointMultiServiceType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private endpoint."
+                                          }
+                                        },
+                                        "location": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The location to deploy the private endpoint to."
+                                          }
+                                        },
+                                        "privateLinkServiceConnectionName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name of the private link connection to create."
+                                          }
+                                        },
+                                        "service": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
+                                          }
+                                        },
+                                        "subnetResourceId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                          }
+                                        },
+                                        "resourceGroupResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
+                                          }
+                                        },
+                                        "privateDnsZoneGroup": {
+                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                          }
+                                        },
+                                        "isManualConnection": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. If Manual Private Link Connection is required."
+                                          }
+                                        },
+                                        "manualConnectionRequestMessage": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "maxLength": 140,
+                                          "metadata": {
+                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
+                                          }
+                                        },
+                                        "customDnsConfigs": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Custom DNS configurations."
+                                          }
+                                        },
+                                        "ipConfigurations": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                          }
+                                        },
+                                        "applicationSecurityGroupResourceIds": {
+                                          "type": "array",
+                                          "items": {
+                                            "type": "string"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                          }
+                                        },
+                                        "customNetworkInterfaceName": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                          }
+                                        },
+                                        "lock": {
+                                          "$ref": "#/definitions/lockType",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Specify the type of lock."
+                                          }
+                                        },
+                                        "roleAssignments": {
+                                          "type": "array",
+                                          "items": {
+                                            "$ref": "#/definitions/roleAssignmentType"
+                                          },
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Array of role assignments to create."
+                                          }
+                                        },
+                                        "tags": {
+                                          "type": "object",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "__bicep_resource_derived_type!": {
+                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
+                                            },
+                                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                          }
+                                        },
+                                        "enableTelemetry": {
+                                          "type": "bool",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Enable/Disable usage telemetry for module."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "roleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                          }
+                                        },
+                                        "roleDefinitionIdOrName": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                          }
+                                        },
+                                        "principalType": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "Device",
+                                            "ForeignGroup",
+                                            "Group",
+                                            "ServicePrincipal",
+                                            "User"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The principal type of the assigned principal ID."
+                                          }
+                                        },
+                                        "description": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The description of the role assignment."
+                                          }
+                                        },
+                                        "condition": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                          }
+                                        },
+                                        "conditionVersion": {
+                                          "type": "string",
+                                          "allowedValues": [
+                                            "2.0"
+                                          ],
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Version of the condition."
+                                          }
+                                        },
+                                        "delegatedManagedIdentityResourceId": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "An AVM-aligned type for a role assignment.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
+                                        }
+                                      }
+                                    },
+                                    "sqlRoleAssignmentType": {
+                                      "type": "object",
+                                      "properties": {
+                                        "name": {
+                                          "type": "string",
+                                          "nullable": true,
+                                          "metadata": {
+                                            "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                          }
+                                        },
+                                        "principalId": {
+                                          "type": "string",
+                                          "metadata": {
+                                            "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                          }
+                                        }
+                                      },
+                                      "metadata": {
+                                        "description": "The type for the SQL Role Assignments.",
+                                        "__bicep_imported_from!": {
+                                          "sourceTemplate": "sql-role-definition/main.bicep"
+                                        }
+                                      }
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the account."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "defaultValue": "[resourceGroup().location]",
+                                      "metadata": {
+                                        "description": "Optional. Defaults to the current resource group scope location. Location for all resources."
+                                      }
+                                    },
+                                    "tags": {
+                                      "type": "object",
+                                      "metadata": {
+                                        "__bicep_resource_derived_type!": {
+                                          "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags"
+                                        },
+                                        "description": "Optional. Tags for the resource."
+                                      },
+                                      "nullable": true
+                                    },
+                                    "managedIdentities": {
+                                      "$ref": "#/definitions/managedIdentityAllType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The managed identity definition for this resource."
+                                      }
+                                    },
+                                    "databaseAccountOfferType": {
+                                      "type": "string",
+                                      "defaultValue": "Standard",
+                                      "allowedValues": [
+                                        "Standard"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The offer type for the account. Defaults to \"Standard\"."
+                                      }
+                                    },
+                                    "failoverLocations": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/failoverLocationType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed."
+                                      }
+                                    },
+                                    "zoneRedundant": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts."
+                                      }
+                                    },
+                                    "defaultConsistencyLevel": {
+                                      "type": "string",
+                                      "defaultValue": "Session",
+                                      "allowedValues": [
+                                        "Eventual",
+                                        "ConsistentPrefix",
+                                        "Session",
+                                        "BoundedStaleness",
+                                        "Strong"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. The default consistency level of the account. Defaults to \"Session\"."
+                                      }
+                                    },
+                                    "disableLocalAuthentication": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true."
+                                      }
+                                    },
+                                    "enableAnalyticalStorage": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false."
+                                      }
+                                    },
+                                    "automaticFailover": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable automatic failover for regions. Defaults to true."
+                                      }
+                                    },
+                                    "enableFreeTier": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false."
+                                      }
+                                    },
+                                    "enableMultipleWriteLocations": {
+                                      "type": "bool",
+                                      "defaultValue": false,
+                                      "metadata": {
+                                        "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false."
+                                      }
+                                    },
+                                    "disableKeyBasedMetadataWriteAccess": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true."
+                                      }
+                                    },
+                                    "maxStalenessPrefix": {
+                                      "type": "int",
+                                      "defaultValue": 100000,
+                                      "minValue": 1,
+                                      "maxValue": 2147483647,
+                                      "metadata": {
+                                        "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000."
+                                      }
+                                    },
+                                    "maxIntervalInSeconds": {
+                                      "type": "int",
+                                      "defaultValue": 300,
+                                      "minValue": 5,
+                                      "maxValue": 86400,
+                                      "metadata": {
+                                        "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300."
+                                      }
+                                    },
+                                    "serverVersion": {
+                                      "type": "string",
+                                      "defaultValue": "4.2",
+                                      "allowedValues": [
+                                        "3.2",
+                                        "3.6",
+                                        "4.0",
+                                        "4.2",
+                                        "5.0",
+                                        "6.0",
+                                        "7.0"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"."
+                                      }
+                                    },
+                                    "sqlDatabases": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/sqlDatabaseType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL."
+                                      }
+                                    },
+                                    "mongodbDatabases": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU."
+                                      }
+                                    },
+                                    "gremlinDatabases": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin."
+                                      }
+                                    },
+                                    "tables": {
+                                      "type": "array",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table."
+                                      }
+                                    },
+                                    "enableTelemetry": {
+                                      "type": "bool",
+                                      "defaultValue": true,
+                                      "metadata": {
+                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                      }
+                                    },
+                                    "totalThroughputLimit": {
+                                      "type": "int",
+                                      "defaultValue": -1,
+                                      "metadata": {
+                                        "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput."
+                                      }
+                                    },
+                                    "lock": {
+                                      "$ref": "#/definitions/lockType",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The lock settings of the service."
+                                      }
+                                    },
+                                    "roleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/roleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. An array of control plane Azure role-based access control assignments."
+                                      }
+                                    },
+                                    "dataPlaneRoleDefinitions": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/dataPlaneRoleDefinitionType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions."
+                                      }
+                                    },
+                                    "dataPlaneRoleAssignments": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/dataPlaneRoleAssignmentType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments."
+                                      }
+                                    },
+                                    "diagnosticSettings": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/diagnosticSettingFullType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. The diagnostic settings for the service."
+                                      }
+                                    },
+                                    "capabilitiesToAdd": {
+                                      "type": "array",
+                                      "items": {
+                                        "type": "string"
+                                      },
+                                      "nullable": true,
+                                      "allowedValues": [
+                                        "EnableCassandra",
+                                        "EnableTable",
+                                        "EnableGremlin",
+                                        "EnableMongo",
+                                        "DisableRateLimitingResponses",
+                                        "EnableServerless",
+                                        "EnableNoSQLVectorSearch",
+                                        "EnableNoSQLFullTextSearch",
+                                        "EnableMaterializedViews",
+                                        "DeleteAllItemsByPartitionKey"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account."
+                                      }
+                                    },
+                                    "backupPolicyType": {
+                                      "type": "string",
+                                      "defaultValue": "Continuous",
+                                      "allowedValues": [
+                                        "Periodic",
+                                        "Continuous"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"."
+                                      }
+                                    },
+                                    "backupPolicyContinuousTier": {
+                                      "type": "string",
+                                      "defaultValue": "Continuous30Days",
+                                      "allowedValues": [
+                                        "Continuous30Days",
+                                        "Continuous7Days"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"."
+                                      }
+                                    },
+                                    "backupIntervalInMinutes": {
+                                      "type": "int",
+                                      "defaultValue": 240,
+                                      "minValue": 60,
+                                      "maxValue": 1440,
+                                      "metadata": {
+                                        "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240."
+                                      }
+                                    },
+                                    "backupRetentionIntervalInHours": {
+                                      "type": "int",
+                                      "defaultValue": 8,
+                                      "minValue": 2,
+                                      "maxValue": 720,
+                                      "metadata": {
+                                        "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8."
+                                      }
+                                    },
+                                    "backupStorageRedundancy": {
+                                      "type": "string",
+                                      "defaultValue": "Local",
+                                      "allowedValues": [
+                                        "Geo",
+                                        "Local",
+                                        "Zone"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"."
+                                      }
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointMultiServiceType"
+                                      },
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible."
+                                      }
+                                    },
+                                    "networkRestrictions": {
+                                      "$ref": "#/definitions/networkRestrictionType",
+                                      "defaultValue": {
+                                        "ipRules": [],
+                                        "virtualNetworkRules": [],
+                                        "publicNetworkAccess": "Disabled"
+                                      },
+                                      "metadata": {
+                                        "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
+                                      }
+                                    },
+                                    "minimumTlsVersion": {
+                                      "type": "string",
+                                      "defaultValue": "Tls12",
+                                      "allowedValues": [
+                                        "Tls12"
+                                      ],
+                                      "metadata": {
+                                        "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "copy": [
+                                      {
+                                        "name": "formattedRoleAssignments",
+                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                      }
+                                    ],
+                                    "enableReferencedModulesTelemetry": false,
+                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                                    "builtInControlPlaneRoleNames": {
+                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                      "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
+                                      "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
+                                      "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
+                                      "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
+                                      "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
+                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                                    }
+                                  },
+                                  "resources": {
+                                    "avmTelemetry": {
+                                      "condition": "[parameters('enableTelemetry')]",
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2024-07-01",
+                                      "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                      "properties": {
+                                        "mode": "Incremental",
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "contentVersion": "1.0.0.0",
+                                          "resources": [],
+                                          "outputs": {
+                                            "telemetry": {
+                                              "type": "String",
+                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                            }
+                                          }
+                                        }
+                                      }
+                                    },
+                                    "databaseAccount": {
+                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                      "apiVersion": "2024-11-15",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "tags": "[parameters('tags')]",
+                                      "identity": "[variables('identity')]",
+                                      "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]",
+                                      "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]"
+                                    },
+                                    "databaseAccount_lock": {
+                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                      "type": "Microsoft.Authorization/locks",
+                                      "apiVersion": "2020-05-01",
+                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                      "properties": {
+                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_diagnosticSettings": {
+                                      "copy": {
+                                        "name": "databaseAccount_diagnosticSettings",
+                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Insights/diagnosticSettings",
+                                      "apiVersion": "2021-05-01-preview",
+                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                                      "properties": {
+                                        "copy": [
+                                          {
+                                            "name": "metrics",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                                            "input": {
+                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                                              "timeGrain": null
+                                            }
+                                          },
+                                          {
+                                            "name": "logs",
+                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
+                                            "input": {
+                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
+                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
+                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
+                                            }
+                                          }
+                                        ],
+                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_roleAssignments": {
+                                      "copy": {
+                                        "name": "databaseAccount_roleAssignments",
+                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
+                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                      "properties": {
+                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_sqlDatabases": {
+                                      "copy": {
+                                        "name": "databaseAccount_sqlDatabases",
+                                        "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]"
+                                          },
+                                          "containers": {
+                                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]"
+                                          },
+                                          "databaseAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "autoscaleSettingsMaxThroughput": {
+                                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "7141543733238879531"
+                                            },
+                                            "name": "DocumentDB Database Account SQL Databases",
+                                            "description": "This module deploys a SQL Database in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the SQL database ."
+                                              }
+                                            },
+                                            "containers": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "object"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of containers to deploy in the SQL database."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                              }
+                                            },
+                                            "autoscaleSettingsMaxThroughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags of the SQL database resource."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "sqlDatabase": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "resource": {
+                                                  "id": "[parameters('name')]"
+                                                },
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            },
+                                            "container": {
+                                              "copy": {
+                                                "name": "container",
+                                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "databaseAccountName": {
+                                                    "value": "[parameters('databaseAccountName')]"
+                                                  },
+                                                  "sqlDatabaseName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
+                                                  },
+                                                  "analyticalStorageTtl": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]"
+                                                  },
+                                                  "autoscaleSettingsMaxThroughput": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
+                                                  },
+                                                  "conflictResolutionPolicy": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]"
+                                                  },
+                                                  "defaultTtl": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]"
+                                                  },
+                                                  "indexingPolicy": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]"
+                                                  },
+                                                  "kind": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]"
+                                                  },
+                                                  "version": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]"
+                                                  },
+                                                  "paths": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]"
+                                                  },
+                                                  "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]",
+                                                  "uniqueKeyPolicyKeys": {
+                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "1789954443166349986"
+                                                    },
+                                                    "name": "DocumentDB Database Account SQL Database Containers",
+                                                    "description": "This module deploys a SQL Database Container in a CosmosDB Account."
+                                                  },
+                                                  "parameters": {
+                                                    "databaseAccountName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "sqlDatabaseName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. Name of the container."
+                                                      }
+                                                    },
+                                                    "analyticalStorageTtl": {
+                                                      "type": "int",
+                                                      "defaultValue": 0,
+                                                      "metadata": {
+                                                        "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
+                                                      }
+                                                    },
+                                                    "conflictResolutionPolicy": {
+                                                      "type": "object",
+                                                      "defaultValue": {},
+                                                      "metadata": {
+                                                        "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
+                                                      }
+                                                    },
+                                                    "defaultTtl": {
+                                                      "type": "int",
+                                                      "defaultValue": -1,
+                                                      "minValue": -1,
+                                                      "maxValue": 2147483647,
+                                                      "metadata": {
+                                                        "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
+                                                      }
+                                                    },
+                                                    "throughput": {
+                                                      "type": "int",
+                                                      "defaultValue": 400,
+                                                      "metadata": {
+                                                        "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                                      }
+                                                    },
+                                                    "autoscaleSettingsMaxThroughput": {
+                                                      "type": "int",
+                                                      "nullable": true,
+                                                      "maxValue": 1000000,
+                                                      "metadata": {
+                                                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
+                                                      }
+                                                    },
+                                                    "tags": {
+                                                      "type": "object",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Tags of the SQL Database resource."
+                                                      }
+                                                    },
+                                                    "paths": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 3,
+                                                      "metadata": {
+                                                        "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
+                                                      }
+                                                    },
+                                                    "indexingPolicy": {
+                                                      "type": "object",
+                                                      "defaultValue": {},
+                                                      "metadata": {
+                                                        "description": "Optional. Indexing policy of the container."
+                                                      }
+                                                    },
+                                                    "uniqueKeyPolicyKeys": {
+                                                      "type": "array",
+                                                      "defaultValue": [],
+                                                      "metadata": {
+                                                        "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
+                                                      }
+                                                    },
+                                                    "kind": {
+                                                      "type": "string",
+                                                      "defaultValue": "Hash",
+                                                      "allowedValues": [
+                                                        "Hash",
+                                                        "MultiHash"
+                                                      ],
+                                                      "metadata": {
+                                                        "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
+                                                      }
+                                                    },
+                                                    "version": {
+                                                      "type": "int",
+                                                      "defaultValue": 1,
+                                                      "allowedValues": [
+                                                        1,
+                                                        2
+                                                      ],
+                                                      "metadata": {
+                                                        "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "partitionKeyPaths",
+                                                        "count": "[length(parameters('paths'))]",
+                                                        "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
+                                                      }
+                                                    ],
+                                                    "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
+                                                  },
+                                                  "resources": {
+                                                    "databaseAccount::sqlDatabase": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
+                                                    },
+                                                    "databaseAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[parameters('databaseAccountName')]"
+                                                    },
+                                                    "container": {
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
+                                                      "tags": "[parameters('tags')]",
+                                                      "properties": {
+                                                        "resource": "[variables('containerResourceParams')]",
+                                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
+                                                      },
+                                                      "dependsOn": [
+                                                        "databaseAccount"
+                                                      ]
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the container."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the container."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the resource group the container was created in."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "sqlDatabase"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the SQL database."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the SQL database."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the SQL database was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_sqlRoleDefinitions": {
+                                      "copy": {
+                                        "name": "databaseAccount_sqlRoleDefinitions",
+                                        "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]"
+                                          },
+                                          "dataActions": {
+                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
+                                          },
+                                          "roleName": {
+                                            "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]"
+                                          },
+                                          "assignableScopes": {
+                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
+                                          },
+                                          "sqlRoleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "9570871897890815068"
+                                            },
+                                            "name": "DocumentDB Database Account SQL Role Definitions.",
+                                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
+                                          },
+                                          "definitions": {
+                                            "sqlRoleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true,
+                                                "description": "The type for the SQL Role Assignments."
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The unique identifier of the Role Definition."
+                                              }
+                                            },
+                                            "roleName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
+                                              }
+                                            },
+                                            "dataActions": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "defaultValue": [],
+                                              "metadata": {
+                                                "description": "Optional. An array of data actions that are allowed."
+                                              }
+                                            },
+                                            "assignableScopes": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
+                                              }
+                                            },
+                                            "sqlRoleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/sqlRoleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "enableReferencedModulesTelemetry": false
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "sqlRoleDefinition": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]",
+                                              "properties": {
+                                                "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
+                                                "permissions": [
+                                                  {
+                                                    "dataActions": "[parameters('dataActions')]"
+                                                  }
+                                                ],
+                                                "roleName": "[parameters('roleName')]",
+                                                "type": "CustomRole"
+                                              }
+                                            },
+                                            "databaseAccount_sqlRoleAssignments": {
+                                              "copy": {
+                                                "name": "databaseAccount_sqlRoleAssignments",
+                                                "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "databaseAccountName": {
+                                                    "value": "[parameters('databaseAccountName')]"
+                                                  },
+                                                  "roleDefinitionId": {
+                                                    "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
+                                                  },
+                                                  "principalId": {
+                                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                                  },
+                                                  "enableTelemetry": {
+                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "10102303164433641479"
+                                                    },
+                                                    "name": "DocumentDB Database Account SQL Role Assignments.",
+                                                    "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                                                  },
+                                                  "parameters": {
+                                                    "databaseAccountName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                                      }
+                                                    },
+                                                    "principalId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                                      }
+                                                    },
+                                                    "roleDefinitionId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The unique identifier of the associated SQL Role Definition."
+                                                      }
+                                                    },
+                                                    "enableTelemetry": {
+                                                      "type": "bool",
+                                                      "defaultValue": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Enable/Disable usage telemetry for module."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "avmTelemetry": {
+                                                      "condition": "[parameters('enableTelemetry')]",
+                                                      "type": "Microsoft.Resources/deployments",
+                                                      "apiVersion": "2024-03-01",
+                                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                                      "properties": {
+                                                        "mode": "Incremental",
+                                                        "template": {
+                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                          "contentVersion": "1.0.0.0",
+                                                          "resources": [],
+                                                          "outputs": {
+                                                            "telemetry": {
+                                                              "type": "String",
+                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                            }
+                                                          }
+                                                        }
+                                                      }
+                                                    },
+                                                    "databaseAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[parameters('databaseAccountName')]"
+                                                    },
+                                                    "sqlRoleAssignment": {
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                                                      "properties": {
+                                                        "principalId": "[parameters('principalId')]",
+                                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the SQL Role Assignment."
+                                                      },
+                                                      "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the SQL Role Assignment."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the resource group the SQL Role Definition was created in."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "sqlRoleDefinition"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the SQL Role Definition."
+                                              },
+                                              "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the SQL Role Definition."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the SQL Role Definition was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "roleName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The role name of the SQL Role Definition."
+                                              },
+                                              "value": "[reference('sqlRoleDefinition').roleName]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_sqlRoleAssignments": {
+                                      "copy": {
+                                        "name": "databaseAccount_sqlRoleAssignments",
+                                        "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "roleDefinitionId": {
+                                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
+                                          },
+                                          "principalId": {
+                                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]"
+                                          },
+                                          "name": {
+                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "10102303164433641479"
+                                            },
+                                            "name": "DocumentDB Database Account SQL Role Assignments.",
+                                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Name unique identifier of the SQL Role Assignment."
+                                              }
+                                            },
+                                            "principalId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
+                                              }
+                                            },
+                                            "roleDefinitionId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. The unique identifier of the associated SQL Role Definition."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "sqlRoleAssignment": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
+                                              "properties": {
+                                                "principalId": "[parameters('principalId')]",
+                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
+                                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
+                                              }
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the SQL Role Assignment."
+                                              },
+                                              "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the SQL Role Assignment."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the SQL Role Definition was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_mongodbDatabases": {
+                                      "copy": {
+                                        "name": "databaseAccount_mongodbDatabases",
+                                        "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "collections": {
+                                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "9160691107424630312"
+                                            },
+                                            "name": "DocumentDB Database Account MongoDB Databases",
+                                            "description": "This module deploys a MongoDB Database within a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the mongodb database."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "defaultValue": 400,
+                                              "metadata": {
+                                                "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                              }
+                                            },
+                                            "collections": {
+                                              "type": "array",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Collections in the mongodb database."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags of the resource."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "mongodbDatabase": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "resource": {
+                                                  "id": "[parameters('name')]"
+                                                },
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            },
+                                            "mongodbDatabase_collections": {
+                                              "copy": {
+                                                "name": "mongodbDatabase_collections",
+                                                "count": "[length(coalesce(parameters('collections'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "databaseAccountName": {
+                                                    "value": "[parameters('databaseAccountName')]"
+                                                  },
+                                                  "mongodbDatabaseName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "name": {
+                                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]"
+                                                  },
+                                                  "indexes": {
+                                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]"
+                                                  },
+                                                  "shardKey": {
+                                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]"
+                                                  },
+                                                  "throughput": {
+                                                    "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "14050805189442830205"
+                                                    },
+                                                    "name": "DocumentDB Database Account MongoDB Database Collections",
+                                                    "description": "This module deploys a MongoDB Database Collection."
+                                                  },
+                                                  "parameters": {
+                                                    "databaseAccountName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "mongodbDatabaseName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. Name of the collection."
+                                                      }
+                                                    },
+                                                    "throughput": {
+                                                      "type": "int",
+                                                      "defaultValue": 400,
+                                                      "metadata": {
+                                                        "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
+                                                      }
+                                                    },
+                                                    "indexes": {
+                                                      "type": "array",
+                                                      "metadata": {
+                                                        "description": "Required. Indexes for the collection."
+                                                      }
+                                                    },
+                                                    "shardKey": {
+                                                      "type": "object",
+                                                      "metadata": {
+                                                        "description": "Required. ShardKey for the collection."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": [
+                                                    {
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
+                                                        "resource": {
+                                                          "id": "[parameters('name')]",
+                                                          "indexes": "[parameters('indexes')]",
+                                                          "shardKey": "[parameters('shardKey')]"
+                                                        }
+                                                      }
+                                                    }
+                                                  ],
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the mongodb database collection."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the mongodb database collection."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the resource group the mongodb database collection was created in."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "mongodbDatabase"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the mongodb database."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the mongodb database."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the mongodb database was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_gremlinDatabases": {
+                                      "copy": {
+                                        "name": "databaseAccount_gremlinDatabases",
+                                        "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "graphs": {
+                                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]"
+                                          },
+                                          "maxThroughput": {
+                                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "16834580070429190924"
+                                            },
+                                            "name": "DocumentDB Database Account Gremlin Databases",
+                                            "description": "This module deploys a Gremlin Database within a CosmosDB Account."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the Gremlin database."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags of the Gremlin database resource."
+                                              }
+                                            },
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "graphs": {
+                                              "type": "array",
+                                              "defaultValue": [],
+                                              "metadata": {
+                                                "description": "Optional. Array of graphs to deploy in the Gremlin database."
+                                              }
+                                            },
+                                            "maxThroughput": {
+                                              "type": "int",
+                                              "defaultValue": 4000,
+                                              "metadata": {
+                                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "gremlinDatabase": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                                "resource": {
+                                                  "id": "[parameters('name')]"
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            },
+                                            "gremlinDatabase_gremlinGraphs": {
+                                              "copy": {
+                                                "name": "gremlinDatabase_gremlinGraphs",
+                                                "count": "[length(parameters('graphs'))]"
+                                              },
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[parameters('graphs')[copyIndex()].name]"
+                                                  },
+                                                  "gremlinDatabaseName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "databaseAccountName": {
+                                                    "value": "[parameters('databaseAccountName')]"
+                                                  },
+                                                  "indexingPolicy": {
+                                                    "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
+                                                  },
+                                                  "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.37.4.10188",
+                                                      "templateHash": "15062578211366932944"
+                                                    },
+                                                    "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
+                                                    "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
+                                                  },
+                                                  "parameters": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. Name of the graph."
+                                                      }
+                                                    },
+                                                    "tags": {
+                                                      "type": "object",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. Tags of the Gremlin graph resource."
+                                                      }
+                                                    },
+                                                    "databaseAccountName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "gremlinDatabaseName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "indexingPolicy": {
+                                                      "type": "object",
+                                                      "defaultValue": {},
+                                                      "metadata": {
+                                                        "description": "Optional. Indexing policy of the graph."
+                                                      }
+                                                    },
+                                                    "partitionKeyPaths": {
+                                                      "type": "array",
+                                                      "defaultValue": [],
+                                                      "metadata": {
+                                                        "description": "Optional. List of paths using which data within the container can be partitioned."
+                                                      }
+                                                    }
+                                                  },
+                                                  "resources": {
+                                                    "databaseAccount::gremlinDatabase": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
+                                                    },
+                                                    "databaseAccount": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[parameters('databaseAccountName')]"
+                                                    },
+                                                    "gremlinGraph": {
+                                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
+                                                      "apiVersion": "2024-11-15",
+                                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
+                                                      "tags": "[parameters('tags')]",
+                                                      "properties": {
+                                                        "resource": {
+                                                          "id": "[parameters('name')]",
+                                                          "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
+                                                          "partitionKey": {
+                                                            "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
+                                                          }
+                                                        }
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the graph."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the graph."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the resource group the graph was created in."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "gremlinDatabase"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the Gremlin database."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the Gremlin database."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the Gremlin database was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_tables": {
+                                      "copy": {
+                                        "name": "databaseAccount_tables",
+                                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "databaseAccountName": {
+                                            "value": "[parameters('name')]"
+                                          },
+                                          "name": {
+                                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "maxThroughput": {
+                                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]"
+                                          },
+                                          "throughput": {
+                                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.37.4.10188",
+                                              "templateHash": "3429971823201332257"
+                                            },
+                                            "name": "Azure Cosmos DB account tables",
+                                            "description": "This module deploys a table within an Azure Cosmos DB Account."
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the table."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags for the table."
+                                              }
+                                            },
+                                            "databaseAccountName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
+                                              }
+                                            },
+                                            "maxThroughput": {
+                                              "type": "int",
+                                              "defaultValue": 4000,
+                                              "metadata": {
+                                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
+                                              }
+                                            },
+                                            "throughput": {
+                                              "type": "int",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
+                                              }
+                                            }
+                                          },
+                                          "resources": {
+                                            "databaseAccount": {
+                                              "existing": true,
+                                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[parameters('databaseAccountName')]"
+                                            },
+                                            "table": {
+                                              "type": "Microsoft.DocumentDB/databaseAccounts/tables",
+                                              "apiVersion": "2024-11-15",
+                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
+                                                "resource": {
+                                                  "id": "[parameters('name')]"
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "databaseAccount"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the table."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the table."
+                                              },
+                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
+                                            },
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the resource group the table was created in."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    },
+                                    "databaseAccount_privateEndpoints": {
+                                      "copy": {
+                                        "name": "databaseAccount_privateEndpoints",
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
+                                      },
+                                      "type": "Microsoft.Resources/deployments",
+                                      "apiVersion": "2022-09-01",
+                                      "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
+                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
+                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
+                                      "properties": {
+                                        "expressionEvaluationOptions": {
+                                          "scope": "inner"
+                                        },
+                                        "mode": "Incremental",
+                                        "parameters": {
+                                          "name": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
+                                          },
+                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
+                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
+                                          "subnetResourceId": {
+                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
+                                          },
+                                          "enableTelemetry": {
+                                            "value": "[variables('enableReferencedModulesTelemetry')]"
+                                          },
+                                          "location": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
+                                          },
+                                          "lock": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
+                                          },
+                                          "privateDnsZoneGroup": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
+                                          },
+                                          "roleAssignments": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
+                                          },
+                                          "tags": {
+                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
+                                          },
+                                          "customDnsConfigs": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
+                                          },
+                                          "ipConfigurations": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
+                                          },
+                                          "applicationSecurityGroupResourceIds": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
+                                          },
+                                          "customNetworkInterfaceName": {
+                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
+                                          }
+                                        },
+                                        "template": {
+                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                          "languageVersion": "2.0",
+                                          "contentVersion": "1.0.0.0",
+                                          "metadata": {
+                                            "_generator": {
+                                              "name": "bicep",
+                                              "version": "0.34.44.8038",
+                                              "templateHash": "12389807800450456797"
+                                            },
+                                            "name": "Private Endpoints",
+                                            "description": "This module deploys a Private Endpoint."
+                                          },
+                                          "definitions": {
+                                            "privateDnsZoneGroupType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the Private DNS Zone Group."
+                                                  }
+                                                },
+                                                "privateDnsZoneGroupConfigs": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "ipConfigurationType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the resource that is unique within a resource group."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "memberName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
+                                                      }
+                                                    },
+                                                    "privateIPAddress": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private endpoint IP configurations."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "privateLinkServiceConnectionType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The name of the private link service connection."
+                                                  }
+                                                },
+                                                "properties": {
+                                                  "type": "object",
+                                                  "properties": {
+                                                    "groupIds": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "type": "string"
+                                                      },
+                                                      "metadata": {
+                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
+                                                      }
+                                                    },
+                                                    "privateLinkServiceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Required. The resource id of private link service."
+                                                      }
+                                                    },
+                                                    "requestMessage": {
+                                                      "type": "string",
+                                                      "nullable": true,
+                                                      "metadata": {
+                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
+                                                      }
+                                                    }
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. Properties of private link service connection."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "customDnsConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "fqdn": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
+                                                  }
+                                                },
+                                                "ipAddresses": {
+                                                  "type": "array",
+                                                  "items": {
+                                                    "type": "string"
+                                                  },
+                                                  "metadata": {
+                                                    "description": "Required. A list of private IP addresses of the private endpoint."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_export!": true
+                                              }
+                                            },
+                                            "lockType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the name of lock."
+                                                  }
+                                                },
+                                                "kind": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "CanNotDelete",
+                                                    "None",
+                                                    "ReadOnly"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Specify the type of lock."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a lock.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            },
+                                            "privateDnsZoneGroupConfigType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name of the private DNS zone group config."
+                                                  }
+                                                },
+                                                "privateDnsZoneResourceId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The resource id of the private DNS zone."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
+                                                }
+                                              }
+                                            },
+                                            "roleAssignmentType": {
+                                              "type": "object",
+                                              "properties": {
+                                                "name": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                                                  }
+                                                },
+                                                "roleDefinitionIdOrName": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                                                  }
+                                                },
+                                                "principalId": {
+                                                  "type": "string",
+                                                  "metadata": {
+                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                                                  }
+                                                },
+                                                "principalType": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "Device",
+                                                    "ForeignGroup",
+                                                    "Group",
+                                                    "ServicePrincipal",
+                                                    "User"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The principal type of the assigned principal ID."
+                                                  }
+                                                },
+                                                "description": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The description of the role assignment."
+                                                  }
+                                                },
+                                                "condition": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                                                  }
+                                                },
+                                                "conditionVersion": {
+                                                  "type": "string",
+                                                  "allowedValues": [
+                                                    "2.0"
+                                                  ],
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. Version of the condition."
+                                                  }
+                                                },
+                                                "delegatedManagedIdentityResourceId": {
+                                                  "type": "string",
+                                                  "nullable": true,
+                                                  "metadata": {
+                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
+                                                  }
+                                                }
+                                              },
+                                              "metadata": {
+                                                "description": "An AVM-aligned type for a role assignment.",
+                                                "__bicep_imported_from!": {
+                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
+                                                }
+                                              }
+                                            }
+                                          },
+                                          "parameters": {
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Name of the private endpoint resource to create."
+                                              }
+                                            },
+                                            "subnetResourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
+                                              }
+                                            },
+                                            "applicationSecurityGroupResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
+                                              }
+                                            },
+                                            "customNetworkInterfaceName": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
+                                              }
+                                            },
+                                            "ipConfigurations": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/ipConfigurationType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
+                                              }
+                                            },
+                                            "privateDnsZoneGroup": {
+                                              "$ref": "#/definitions/privateDnsZoneGroupType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
+                                              }
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "defaultValue": "[resourceGroup().location]",
+                                              "metadata": {
+                                                "description": "Optional. Location for all Resources."
+                                              }
+                                            },
+                                            "lock": {
+                                              "$ref": "#/definitions/lockType",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. The lock settings of the service."
+                                              }
+                                            },
+                                            "roleAssignments": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/roleAssignmentType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Array of role assignments to create."
+                                              }
+                                            },
+                                            "tags": {
+                                              "type": "object",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
+                                              }
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Optional. Custom DNS configurations."
+                                              }
+                                            },
+                                            "manualPrivateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "privateLinkServiceConnections": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
+                                              },
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
+                                              }
+                                            },
+                                            "enableTelemetry": {
+                                              "type": "bool",
+                                              "defaultValue": true,
+                                              "metadata": {
+                                                "description": "Optional. Enable/Disable usage telemetry for module."
+                                              }
+                                            }
+                                          },
+                                          "variables": {
+                                            "copy": [
+                                              {
+                                                "name": "formattedRoleAssignments",
+                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                                              }
+                                            ],
+                                            "builtInRoleNames": {
+                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
+                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
+                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
+                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
+                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
+                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
+                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
+                                            }
+                                          },
+                                          "resources": {
+                                            "avmTelemetry": {
+                                              "condition": "[parameters('enableTelemetry')]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2024-03-01",
+                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                                              "properties": {
+                                                "mode": "Incremental",
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "resources": [],
+                                                  "outputs": {
+                                                    "telemetry": {
+                                                      "type": "String",
+                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                                                    }
+                                                  }
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint": {
+                                              "type": "Microsoft.Network/privateEndpoints",
+                                              "apiVersion": "2024-05-01",
+                                              "name": "[parameters('name')]",
+                                              "location": "[parameters('location')]",
+                                              "tags": "[parameters('tags')]",
+                                              "properties": {
+                                                "copy": [
+                                                  {
+                                                    "name": "applicationSecurityGroups",
+                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
+                                                    "input": {
+                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
+                                                    }
+                                                  }
+                                                ],
+                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
+                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
+                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
+                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
+                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
+                                                "subnet": {
+                                                  "id": "[parameters('subnetResourceId')]"
+                                                }
+                                              }
+                                            },
+                                            "privateEndpoint_lock": {
+                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                                              "type": "Microsoft.Authorization/locks",
+                                              "apiVersion": "2020-05-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                                              "properties": {
+                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_roleAssignments": {
+                                              "copy": {
+                                                "name": "privateEndpoint_roleAssignments",
+                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                                              },
+                                              "type": "Microsoft.Authorization/roleAssignments",
+                                              "apiVersion": "2022-04-01",
+                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
+                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                                              "properties": {
+                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            },
+                                            "privateEndpoint_privateDnsZoneGroup": {
+                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
+                                              "type": "Microsoft.Resources/deployments",
+                                              "apiVersion": "2022-09-01",
+                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
+                                              "properties": {
+                                                "expressionEvaluationOptions": {
+                                                  "scope": "inner"
+                                                },
+                                                "mode": "Incremental",
+                                                "parameters": {
+                                                  "name": {
+                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
+                                                  },
+                                                  "privateEndpointName": {
+                                                    "value": "[parameters('name')]"
+                                                  },
+                                                  "privateDnsZoneConfigs": {
+                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
+                                                  }
+                                                },
+                                                "template": {
+                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                                  "languageVersion": "2.0",
+                                                  "contentVersion": "1.0.0.0",
+                                                  "metadata": {
+                                                    "_generator": {
+                                                      "name": "bicep",
+                                                      "version": "0.34.44.8038",
+                                                      "templateHash": "13997305779829540948"
+                                                    },
+                                                    "name": "Private Endpoint Private DNS Zone Groups",
+                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
+                                                  },
+                                                  "definitions": {
+                                                    "privateDnsZoneGroupConfigType": {
+                                                      "type": "object",
+                                                      "properties": {
+                                                        "name": {
+                                                          "type": "string",
+                                                          "nullable": true,
+                                                          "metadata": {
+                                                            "description": "Optional. The name of the private DNS zone group config."
+                                                          }
+                                                        },
+                                                        "privateDnsZoneResourceId": {
+                                                          "type": "string",
+                                                          "metadata": {
+                                                            "description": "Required. The resource id of the private DNS zone."
+                                                          }
+                                                        }
+                                                      },
+                                                      "metadata": {
+                                                        "__bicep_export!": true
+                                                      }
+                                                    }
+                                                  },
+                                                  "parameters": {
+                                                    "privateEndpointName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
+                                                      }
+                                                    },
+                                                    "privateDnsZoneConfigs": {
+                                                      "type": "array",
+                                                      "items": {
+                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
+                                                      },
+                                                      "minLength": 1,
+                                                      "maxLength": 5,
+                                                      "metadata": {
+                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
+                                                      }
+                                                    },
+                                                    "name": {
+                                                      "type": "string",
+                                                      "defaultValue": "default",
+                                                      "metadata": {
+                                                        "description": "Optional. The name of the private DNS zone group."
+                                                      }
+                                                    }
+                                                  },
+                                                  "variables": {
+                                                    "copy": [
+                                                      {
+                                                        "name": "privateDnsZoneConfigsVar",
+                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
+                                                        "input": {
+                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
+                                                          "properties": {
+                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
+                                                          }
+                                                        }
+                                                      }
+                                                    ]
+                                                  },
+                                                  "resources": {
+                                                    "privateEndpoint": {
+                                                      "existing": true,
+                                                      "type": "Microsoft.Network/privateEndpoints",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[parameters('privateEndpointName')]"
+                                                    },
+                                                    "privateDnsZoneGroup": {
+                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
+                                                      "apiVersion": "2024-05-01",
+                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
+                                                      "properties": {
+                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
+                                                      }
+                                                    }
+                                                  },
+                                                  "outputs": {
+                                                    "name": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The name of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[parameters('name')]"
+                                                    },
+                                                    "resourceId": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource ID of the private endpoint DNS zone group."
+                                                      },
+                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
+                                                    },
+                                                    "resourceGroupName": {
+                                                      "type": "string",
+                                                      "metadata": {
+                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
+                                                      },
+                                                      "value": "[resourceGroup().name]"
+                                                    }
+                                                  }
+                                                }
+                                              },
+                                              "dependsOn": [
+                                                "privateEndpoint"
+                                              ]
+                                            }
+                                          },
+                                          "outputs": {
+                                            "resourceGroupName": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource group the private endpoint was deployed into."
+                                              },
+                                              "value": "[resourceGroup().name]"
+                                            },
+                                            "resourceId": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The resource ID of the private endpoint."
+                                              },
+                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
+                                            },
+                                            "name": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The name of the private endpoint."
+                                              },
+                                              "value": "[parameters('name')]"
+                                            },
+                                            "location": {
+                                              "type": "string",
+                                              "metadata": {
+                                                "description": "The location the resource was deployed into."
+                                              },
+                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
+                                            },
+                                            "customDnsConfigs": {
+                                              "type": "array",
+                                              "items": {
+                                                "$ref": "#/definitions/customDnsConfigType"
+                                              },
+                                              "metadata": {
+                                                "description": "The custom DNS configurations of the private endpoint."
+                                              },
+                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
+                                            },
+                                            "networkInterfaceResourceIds": {
+                                              "type": "array",
+                                              "items": {
+                                                "type": "string"
+                                              },
+                                              "metadata": {
+                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
+                                              },
+                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
+                                            },
+                                            "groupId": {
+                                              "type": "string",
+                                              "nullable": true,
+                                              "metadata": {
+                                                "description": "The group Id for the private endpoint Group."
+                                              },
+                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
+                                            }
+                                          }
+                                        }
+                                      },
+                                      "dependsOn": [
+                                        "databaseAccount"
+                                      ]
+                                    }
+                                  },
+                                  "outputs": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the database account."
+                                      },
+                                      "value": "[parameters('name')]"
+                                    },
+                                    "resourceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The resource ID of the database account."
+                                      },
+                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
+                                    },
+                                    "resourceGroupName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The name of the resource group the database account was created in."
+                                      },
+                                      "value": "[resourceGroup().name]"
+                                    },
+                                    "systemAssignedMIPrincipalId": {
+                                      "type": "string",
+                                      "nullable": true,
+                                      "metadata": {
+                                        "description": "The principal ID of the system assigned identity."
+                                      },
+                                      "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]"
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The location the resource was deployed into."
+                                      },
+                                      "value": "[reference('databaseAccount', '2024-11-15', 'full').location]"
+                                    },
+                                    "endpoint": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "The endpoint of the database account."
+                                      },
+                                      "value": "[reference('databaseAccount').documentEndpoint]"
+                                    },
+                                    "privateEndpoints": {
+                                      "type": "array",
+                                      "items": {
+                                        "$ref": "#/definitions/privateEndpointOutputType"
+                                      },
+                                      "metadata": {
+                                        "description": "The private endpoints of the database account."
+                                      },
+                                      "copy": {
+                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
+                                        "input": {
+                                          "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
+                                          "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
+                                          "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
+                                          "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
+                                          "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
+                                        }
+                                      }
+                                    },
+                                    "primaryReadWriteKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary read-write key."
+                                      },
+                                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]"
+                                    },
+                                    "primaryReadOnlyKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary read-only key."
+                                      },
+                                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]"
+                                    },
+                                    "primaryReadWriteConnectionString": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary read-write connection string."
+                                      },
+                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]"
+                                    },
+                                    "primaryReadOnlyConnectionString": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The primary read-only connection string."
+                                      },
+                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]"
+                                    },
+                                    "secondaryReadWriteKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondary read-write key."
+                                      },
+                                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]"
+                                    },
+                                    "secondaryReadOnlyKey": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondary read-only key."
+                                      },
+                                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]"
+                                    },
+                                    "secondaryReadWriteConnectionString": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondary read-write connection string."
+                                      },
+                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]"
+                                    },
+                                    "secondaryReadOnlyConnectionString": {
+                                      "type": "securestring",
+                                      "metadata": {
+                                        "description": "The secondary read-only connection string."
+                                      },
+                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]"
+                                    }
+                                  }
+                                }
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the Cosmos DB."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.name.value, variables('existingName'))]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the Cosmos DB."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.DocumentDB/databaseAccounts', variables('existingName')))]"
+                            },
+                            "subscriptionId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Subscription ID of the Cosmos DB."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource Group Name of the Cosmos DB."
+                              },
+                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "foundryProject": {
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[take(format('module.project.main.{0}', variables('projectName')), 64)]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "name": {
+                            "value": "[variables('projectName')]"
+                          },
+                          "desc": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'desc'))), createObject('value', parameters('aiFoundryConfiguration').project.desc), createObject('value', 'This is the default project for AI Foundry.'))]",
+                          "displayName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'displayName'))), createObject('value', parameters('aiFoundryConfiguration').project.displayName), createObject('value', format('{0} Default Project', parameters('baseName'))))]",
+                          "accountName": {
+                            "value": "[reference('foundryAccount').outputs.name.value]"
+                          },
+                          "location": {
+                            "value": "[reference('foundryAccount').outputs.location.value]"
+                          },
+                          "createAccountCapabilityHost": {
+                            "value": "[and(variables('createCapabilityHosts'), empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')))]"
+                          },
+                          "createProjectCapabilityHost": {
+                            "value": "[variables('createCapabilityHosts')]"
+                          },
+                          "storageAccountConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('storageAccount').outputs.name.value, 'subscriptionId', reference('storageAccount').outputs.subscriptionId.value, 'resourceGroupName', reference('storageAccount').outputs.resourceGroupName.value)), createObject('value', null()))]",
+                          "aiSearchConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('aiSearch').outputs.name.value, 'subscriptionId', reference('aiSearch').outputs.subscriptionId.value, 'resourceGroupName', reference('aiSearch').outputs.resourceGroupName.value)), createObject('value', null()))]",
+                          "cosmosDbConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('cosmosDb').outputs.name.value, 'subscriptionId', reference('cosmosDb').outputs.subscriptionId.value, 'resourceGroupName', reference('cosmosDb').outputs.resourceGroupName.value)), createObject('value', null()))]",
+                          "tags": {
+                            "value": "[parameters('tags')]"
+                          },
+                          "lock": {
+                            "value": "[parameters('lock')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "8997226659817763257"
+                            },
+                            "name": "AI Foundry Project",
+                            "description": "Creates an AI Foundry project and any associated Azure service connections."
+                          },
+                          "definitions": {
+                            "azureConnectionType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. The name of the project connection. Will default to the resource name if not provided."
+                                  }
+                                },
+                                "resourceName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource name of the Azure resource for the connection."
+                                  }
+                                },
+                                "subscriptionId": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The subscription ID of the resource."
+                                  }
+                                },
+                                "resourceGroupName": {
+                                  "type": "string",
+                                  "metadata": {
+                                    "description": "Required. The resource group name of the resource."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "__bicep_export!": true,
+                                "description": "Type representing values to create an Azure connection to an AI Foundry project."
+                              }
+                            },
+                            "lockType": {
+                              "type": "object",
+                              "properties": {
+                                "name": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the name of lock."
+                                  }
+                                },
+                                "kind": {
+                                  "type": "string",
+                                  "allowedValues": [
+                                    "CanNotDelete",
+                                    "None",
+                                    "ReadOnly"
+                                  ],
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the type of lock."
+                                  }
+                                },
+                                "notes": {
+                                  "type": "string",
+                                  "nullable": true,
+                                  "metadata": {
+                                    "description": "Optional. Specify the notes of the lock."
+                                  }
+                                }
+                              },
+                              "metadata": {
+                                "description": "An AVM-aligned type for a lock.",
+                                "__bicep_imported_from!": {
+                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                                }
+                              }
+                            }
+                          },
+                          "parameters": {
+                            "name": {
+                              "type": "string",
+                              "minLength": 2,
+                              "maxLength": 64,
+                              "metadata": {
+                                "description": "Required. The name of the AI Foundry project."
+                              }
+                            },
+                            "displayName": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The display name of the AI Foundry project."
+                              }
+                            },
+                            "desc": {
+                              "type": "string",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The description of the AI Foundry project."
+                              }
+                            },
+                            "location": {
+                              "type": "string",
+                              "defaultValue": "[resourceGroup().location]",
+                              "metadata": {
+                                "description": "Optional. Specifies the location for all the Azure resources."
+                              }
+                            },
+                            "accountName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Required. Name of the existing parent Foundry Account resource."
+                              }
+                            },
+                            "createAccountCapabilityHost": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Whether to create the capability host for the Foundry account. Requires associated resource connections to be provided."
+                              }
+                            },
+                            "createProjectCapabilityHost": {
+                              "type": "bool",
+                              "metadata": {
+                                "description": "Required. Whether to create the capability host for the Foundry project. Requires associated resource connections to be provided."
+                              }
+                            },
+                            "cosmosDbConnection": {
+                              "$ref": "#/definitions/azureConnectionType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Cosmos DB connection for the project."
+                              }
+                            },
+                            "aiSearchConnection": {
+                              "$ref": "#/definitions/azureConnectionType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Azure Cognitive Search connection for the project."
+                              }
+                            },
+                            "storageAccountConnection": {
+                              "$ref": "#/definitions/azureConnectionType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. Storage Account connection for the project."
+                              }
+                            },
+                            "lock": {
+                              "$ref": "#/definitions/lockType",
+                              "nullable": true,
+                              "metadata": {
+                                "description": "Optional. The lock settings of the service."
+                              }
+                            },
+                            "tags": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
+                                },
+                                "description": "Optional. Tags to be applied to the resources."
+                              },
+                              "defaultValue": {}
+                            }
+                          },
+                          "variables": {
+                            "hasConnection": "[or(or(not(empty(parameters('cosmosDbConnection'))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]",
+                            "createProjectCapabilityHostInternal": "[and(and(and(parameters('createProjectCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]",
+                            "createAccountCapabilityHostInternal": "[and(and(and(parameters('createAccountCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]"
+                          },
+                          "resources": {
+                            "foundryAccount": {
+                              "existing": true,
+                              "type": "Microsoft.CognitiveServices/accounts",
+                              "apiVersion": "2025-06-01",
+                              "name": "[parameters('accountName')]"
+                            },
+                            "storageAccount": {
+                              "condition": "[not(empty(parameters('storageAccountConnection')))]",
+                              "existing": true,
+                              "type": "Microsoft.Storage/storageAccounts",
+                              "apiVersion": "2025-01-01",
+                              "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]",
+                              "name": "[parameters('storageAccountConnection').resourceName]"
+                            },
+                            "aiSearch": {
+                              "condition": "[not(empty(parameters('aiSearchConnection')))]",
+                              "existing": true,
+                              "type": "Microsoft.Search/searchServices",
+                              "apiVersion": "2025-05-01",
+                              "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]",
+                              "name": "[parameters('aiSearchConnection').resourceName]"
+                            },
+                            "cosmosDb": {
+                              "condition": "[not(empty(parameters('cosmosDbConnection')))]",
+                              "existing": true,
+                              "type": "Microsoft.DocumentDB/databaseAccounts",
+                              "apiVersion": "2025-04-15",
+                              "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]",
+                              "name": "[parameters('cosmosDbConnection').resourceName]"
+                            },
+                            "project": {
+                              "type": "Microsoft.CognitiveServices/accounts/projects",
+                              "apiVersion": "2025-04-01-preview",
+                              "name": "[format('{0}/{1}', parameters('accountName'), parameters('name'))]",
+                              "location": "[parameters('location')]",
+                              "identity": {
+                                "type": "SystemAssigned"
+                              },
+                              "properties": {
+                                "displayName": "[if(not(empty(parameters('displayName'))), parameters('displayName'), parameters('name'))]",
+                                "description": "[if(not(empty(parameters('desc'))), parameters('desc'), parameters('name'))]"
+                              },
+                              "tags": "[parameters('tags')]"
+                            },
+                            "cosmosDbConnectionResource": {
+                              "condition": "[not(empty(parameters('cosmosDbConnection')))]",
+                              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+                              "apiVersion": "2025-04-01-preview",
+                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('cosmosDbConnection').resourceName)]",
+                              "properties": {
+                                "category": "CosmosDB",
+                                "target": "[reference('cosmosDb').documentEndpoint]",
+                                "authType": "AAD",
+                                "metadata": {
+                                  "ApiType": "Azure",
+                                  "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('cosmosDbConnection').subscriptionId, parameters('cosmosDbConnection').resourceGroupName), 'Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbConnection').resourceName)]",
+                                  "location": "[reference('cosmosDb', '2025-04-15', 'full').location]"
+                                }
+                              },
+                              "dependsOn": [
+                                "cosmosDb",
+                                "cosmosDbRoleAssignments",
+                                "project",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "storageAccountConnectionResource": {
+                              "condition": "[not(empty(parameters('storageAccountConnection')))]",
+                              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+                              "apiVersion": "2025-04-01-preview",
+                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('storageAccountConnection').resourceName)]",
+                              "properties": {
+                                "category": "AzureStorageAccount",
+                                "target": "[reference('storageAccount').primaryEndpoints.blob]",
+                                "authType": "AAD",
+                                "metadata": {
+                                  "ApiType": "Azure",
+                                  "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('storageAccountConnection').subscriptionId, parameters('storageAccountConnection').resourceGroupName), 'Microsoft.Storage/storageAccounts', parameters('storageAccountConnection').resourceName)]",
+                                  "location": "[reference('storageAccount', '2025-01-01', 'full').location]"
+                                }
+                              },
+                              "dependsOn": [
+                                "cosmosDbConnectionResource",
+                                "project",
+                                "storageAccount",
+                                "storageAccountRoleAssignments",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "aiSearchConnectionResource": {
+                              "condition": "[not(empty(parameters('aiSearchConnection')))]",
+                              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
+                              "apiVersion": "2025-04-01-preview",
+                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('aiSearchConnection').resourceName)]",
+                              "properties": {
+                                "category": "CognitiveSearch",
+                                "target": "[format('https://{0}.search.windows.net/', parameters('aiSearchConnection').resourceName)]",
+                                "authType": "AAD",
+                                "metadata": {
+                                  "ApiType": "Azure",
+                                  "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('aiSearchConnection').subscriptionId, parameters('aiSearchConnection').resourceGroupName), 'Microsoft.Search/searchServices', parameters('aiSearchConnection').resourceName)]",
+                                  "location": "[reference('aiSearch', '2025-05-01', 'full').location]"
+                                }
+                              },
+                              "dependsOn": [
+                                "aiSearch",
+                                "aiSearchRoleAssignments",
+                                "cosmosDbConnectionResource",
+                                "project",
+                                "storageAccountConnectionResource",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "accountCapabilityHost": {
+                              "condition": "[variables('createAccountCapabilityHostInternal')]",
+                              "type": "Microsoft.CognitiveServices/accounts/capabilityHosts",
+                              "apiVersion": "2025-04-01-preview",
+                              "name": "[format('{0}/{1}', parameters('accountName'), format('chagent{0}', replace(parameters('accountName'), '-', '')))]",
+                              "properties": {
+                                "capabilityHostKind": "Agents",
+                                "tags": "[parameters('tags')]"
+                              },
+                              "dependsOn": [
+                                "aiSearchConnectionResource",
+                                "cosmosDbConnectionResource",
+                                "project",
+                                "storageAccountConnectionResource",
+                                "waitForConnectionsScript"
+                              ]
+                            },
+                            "capabilityHost": {
+                              "condition": "[variables('createProjectCapabilityHostInternal')]",
+                              "type": "Microsoft.CognitiveServices/accounts/projects/capabilityHosts",
+                              "apiVersion": "2025-04-01-preview",
+                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), format('chagent{0}', replace(parameters('name'), '-', '')))]",
+                              "properties": {
+                                "capabilityHostKind": "Agents",
+                                "threadStorageConnections": [
+                                  "[format('{0}', parameters('cosmosDbConnection').resourceName)]"
+                                ],
+                                "vectorStoreConnections": [
+                                  "[format('{0}', parameters('aiSearchConnection').resourceName)]"
+                                ],
+                                "storageConnections": [
+                                  "[format('{0}', parameters('storageAccountConnection').resourceName)]"
+                                ],
+                                "tags": "[parameters('tags')]"
+                              },
+                              "dependsOn": [
+                                "accountCapabilityHost",
+                                "aiSearchConnectionResource",
+                                "cosmosDbConnectionResource",
+                                "project",
+                                "storageAccountConnectionResource",
+                                "waitForConnectionsScript"
+                              ]
+                            },
+                            "projectLock": {
+                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                              "type": "Microsoft.Authorization/locks",
+                              "apiVersion": "2020-05-01",
+                              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', parameters('accountName'), parameters('name'))]",
+                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                              "properties": {
+                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                              },
+                              "dependsOn": [
+                                "capabilityHost",
+                                "project"
+                              ]
+                            },
+                            "waitForProjectScript": {
+                              "condition": "[variables('hasConnection')]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.waitDeploymentScript.waitForProject.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[format('script-wait-proj-{0}', parameters('name'))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "seconds": {
+                                    "value": 30
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "16818353602719638288"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the deployment script."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Location for the deployment script."
+                                      }
+                                    },
+                                    "seconds": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. Sleep/wait time for the deployment script in seconds."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Resources/deploymentScripts",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "AzurePowerShell",
+                                      "properties": {
+                                        "azPowerShellVersion": "11.0",
+                                        "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]",
+                                        "timeout": "P1D",
+                                        "cleanupPreference": "Always",
+                                        "retentionInterval": "P1D"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "project"
+                              ]
+                            },
+                            "cosmosDbRoleAssignments": {
+                              "condition": "[not(empty(parameters('cosmosDbConnection')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.role-assign.cosmosDb.{0}', parameters('name')), 64)]",
+                              "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "cosmosDbName": {
+                                    "value": "[parameters('cosmosDbConnection').resourceName]"
+                                  },
+                                  "projectIdentityPrincipalId": {
+                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "2297586848184477491"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "cosmosDbName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Cosmos DB account."
+                                      }
+                                    },
+                                    "projectIdentityPrincipalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The principal ID of the project identity."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('cosmosDbName'))]",
+                                      "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')))]",
+                                      "properties": {
+                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
+                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
+                                        "principalType": "ServicePrincipal"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "project",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "storageAccountRoleAssignments": {
+                              "condition": "[not(empty(parameters('storageAccountConnection')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.role-assign.storageAccount.{0}', parameters('name')), 64)]",
+                              "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountConnection').resourceName]"
+                                  },
+                                  "projectIdentityPrincipalId": {
+                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "16405095293780360423"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the storage account."
+                                      }
+                                    },
+                                    "projectIdentityPrincipalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The principal ID of the project identity."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
+                                      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]",
+                                      "properties": {
+                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
+                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
+                                        "principalType": "ServicePrincipal"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "project",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "aiSearchRoleAssignments": {
+                              "condition": "[not(empty(parameters('aiSearchConnection')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.role-assign.aiSearch.{0}', parameters('name')), 64)]",
+                              "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "aiSearchName": {
+                                    "value": "[parameters('aiSearchConnection').resourceName]"
+                                  },
+                                  "projectIdentityPrincipalId": {
+                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "16025941000331400340"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "aiSearchName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the AI Search resource."
+                                      }
+                                    },
+                                    "projectIdentityPrincipalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The principal ID of the project identity."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]",
+                                      "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]",
+                                      "properties": {
+                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
+                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
+                                        "principalType": "ServicePrincipal"
+                                      }
+                                    },
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]",
+                                      "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]",
+                                      "properties": {
+                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
+                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
+                                        "principalType": "ServicePrincipal"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "project",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "waitForConnectionsScript": {
+                              "condition": "[and(variables('hasConnection'), or(variables('createAccountCapabilityHostInternal'), variables('createProjectCapabilityHostInternal')))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.waitDeploymentScript.waitForConn.{0}', parameters('name')), 64)]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "name": {
+                                    "value": "[format('script-wait-conns-{0}', parameters('name'))]"
+                                  },
+                                  "location": {
+                                    "value": "[parameters('location')]"
+                                  },
+                                  "seconds": {
+                                    "value": 60
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "16818353602719638288"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "name": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Name of the deployment script."
+                                      }
+                                    },
+                                    "location": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. Location for the deployment script."
+                                      }
+                                    },
+                                    "seconds": {
+                                      "type": "int",
+                                      "metadata": {
+                                        "description": "Required. Sleep/wait time for the deployment script in seconds."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Resources/deploymentScripts",
+                                      "apiVersion": "2023-08-01",
+                                      "name": "[parameters('name')]",
+                                      "location": "[parameters('location')]",
+                                      "kind": "AzurePowerShell",
+                                      "properties": {
+                                        "azPowerShellVersion": "11.0",
+                                        "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]",
+                                        "timeout": "P1D",
+                                        "cleanupPreference": "Always",
+                                        "retentionInterval": "P1D"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "aiSearchConnectionResource",
+                                "cosmosDbConnectionResource",
+                                "project",
+                                "storageAccountConnectionResource",
+                                "waitForProjectScript"
+                              ]
+                            },
+                            "cosmosDbSqlRoleAssignments": {
+                              "condition": "[and(not(empty(parameters('cosmosDbConnection'))), variables('createProjectCapabilityHostInternal'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.role-assign.cosmosDbDataPlane.{0}', parameters('name')), 64)]",
+                              "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "cosmosDbName": {
+                                    "value": "[parameters('cosmosDbConnection').resourceName]"
+                                  },
+                                  "projectIdentityPrincipalId": {
+                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
+                                  },
+                                  "projectWorkspaceId": {
+                                    "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "11649050309693252000"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "cosmosDbName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the Cosmos DB account."
+                                      }
+                                    },
+                                    "projectIdentityPrincipalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The principal ID of the project identity."
+                                      }
+                                    },
+                                    "projectWorkspaceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The project workspace ID."
+                                      }
+                                    }
+                                  },
+                                  "variables": {
+                                    "cosmosContainerNameSuffixes": [
+                                      "thread-message-store",
+                                      "system-thread-message-store",
+                                      "agent-entity-store"
+                                    ],
+                                    "cosmosDefaultSqlRoleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbName'), '00000000-0000-0000-0000-000000000002')]"
+                                  },
+                                  "resources": [
+                                    {
+                                      "copy": {
+                                        "name": "cosmosDataRoleAssigment",
+                                        "count": "[length(variables('cosmosContainerNameSuffixes'))]",
+                                        "mode": "serial",
+                                        "batchSize": 1
+                                      },
+                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
+                                      "apiVersion": "2025-04-15",
+                                      "name": "[format('{0}/{1}', parameters('cosmosDbName'), guid(variables('cosmosDefaultSqlRoleDefinitionId'), parameters('cosmosDbName'), variables('cosmosContainerNameSuffixes')[copyIndex()], parameters('projectIdentityPrincipalId')))]",
+                                      "properties": {
+                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
+                                        "roleDefinitionId": "[variables('cosmosDefaultSqlRoleDefinitionId')]",
+                                        "scope": "[format('{0}/dbs/enterprise_memory/colls/{1}-{2}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')), parameters('projectWorkspaceId'), variables('cosmosContainerNameSuffixes')[copyIndex()])]"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "capabilityHost",
+                                "cosmosDbRoleAssignments",
+                                "project"
+                              ]
+                            },
+                            "storageAccountContainerRoleAssignments": {
+                              "condition": "[and(not(empty(parameters('storageAccountConnection'))), variables('createProjectCapabilityHostInternal'))]",
+                              "type": "Microsoft.Resources/deployments",
+                              "apiVersion": "2025-04-01",
+                              "name": "[take(format('module.project.role-assign.storageAccountDataPlane.{0}', parameters('name')), 64)]",
+                              "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]",
+                              "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]",
+                              "properties": {
+                                "expressionEvaluationOptions": {
+                                  "scope": "inner"
+                                },
+                                "mode": "Incremental",
+                                "parameters": {
+                                  "storageAccountName": {
+                                    "value": "[parameters('storageAccountConnection').resourceName]"
+                                  },
+                                  "projectIdentityPrincipalId": {
+                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
+                                  },
+                                  "projectWorkspaceId": {
+                                    "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]"
+                                  }
+                                },
+                                "template": {
+                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                                  "contentVersion": "1.0.0.0",
+                                  "metadata": {
+                                    "_generator": {
+                                      "name": "bicep",
+                                      "version": "0.38.33.27573",
+                                      "templateHash": "12109249428053532616"
+                                    }
+                                  },
+                                  "parameters": {
+                                    "storageAccountName": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The name of the storage account."
+                                      }
+                                    },
+                                    "projectIdentityPrincipalId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The principal ID of the project identity."
+                                      }
+                                    },
+                                    "projectWorkspaceId": {
+                                      "type": "string",
+                                      "metadata": {
+                                        "description": "Required. The project workspace ID."
+                                      }
+                                    }
+                                  },
+                                  "resources": [
+                                    {
+                                      "type": "Microsoft.Authorization/roleAssignments",
+                                      "apiVersion": "2022-04-01",
+                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
+                                      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]",
+                                      "properties": {
+                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
+                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
+                                        "principalType": "ServicePrincipal",
+                                        "conditionVersion": "2.0",
+                                        "condition": "[replace('      (\n        (\n          !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read''})\n          AND  !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/filter/action''})\n          AND  !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write''})\n        )\n        OR\n        (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringStartsWithIgnoreCase ''#projectWorkspaceId#''\n        AND @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringLikeIgnoreCase ''*-azureml-agent'')\n      )\n      ', '#projectWorkspaceId#', parameters('projectWorkspaceId'))]"
+                                      }
+                                    }
+                                  ]
+                                }
+                              },
+                              "dependsOn": [
+                                "capabilityHost",
+                                "cosmosDbSqlRoleAssignments",
+                                "project",
+                                "storageAccountRoleAssignments"
+                              ]
+                            }
+                          },
+                          "outputs": {
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the deployed Azure Resource Group."
+                              },
+                              "value": "[resourceGroup().name]"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Resource ID of the Project."
+                              },
+                              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('accountName'), parameters('name'))]"
+                            },
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Name of the Project."
+                              },
+                              "value": "[parameters('name')]"
+                            },
+                            "displayName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Display name of the Project."
+                              },
+                              "value": "[reference('project').displayName]"
+                            },
+                            "desc": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Description of the Project."
+                              },
+                              "value": "[reference('project').description]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "aiSearch",
+                        "cosmosDb",
+                        "foundryAccount",
+                        "keyVault",
+                        "storageAccount"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure Resource Group."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "keyVaultName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure Key Vault."
+                      },
+                      "value": "[if(parameters('includeAssociatedResources'), reference('keyVault').outputs.name.value, '')]"
+                    },
+                    "aiServicesName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure AI Services account."
+                      },
+                      "value": "[reference('foundryAccount').outputs.name.value]"
+                    },
+                    "aiSearchName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure AI Search service."
+                      },
+                      "value": "[if(parameters('includeAssociatedResources'), reference('aiSearch').outputs.name.value, '')]"
+                    },
+                    "aiProjectName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure AI Project."
+                      },
+                      "value": "[reference('foundryProject').outputs.name.value]"
+                    },
+                    "storageAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure Storage Account."
+                      },
+                      "value": "[if(parameters('includeAssociatedResources'), reference('storageAccount').outputs.name.value, '')]"
+                    },
+                    "cosmosAccountName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Name of the deployed Azure Cosmos DB account."
+                      },
+                      "value": "[if(parameters('includeAssociatedResources'), reference('cosmosDb').outputs.name.value, '')]"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "outputs": {
+            "aiProjectName": {
+              "type": "string",
+              "value": "[reference('aiFoundry').outputs.aiProjectName.value]"
+            },
+            "aiServicesName": {
+              "type": "string",
+              "value": "[reference('aiFoundry').outputs.aiServicesName.value]"
+            },
+            "location": {
+              "type": "string",
+              "value": "[parameters('location')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "userAssignedIdentity"
+      ]
+    },
+    "openaiRoleAssignment": {
+      "condition": "[not(empty(parameters('existingOpenAIResourceId')))]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('openai-role-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "openAIResourceId": {
+            "value": "[parameters('existingOpenAIResourceId')]"
+          },
+          "principalIds": "[if(not(empty(parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value, parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value)))]"
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "languageVersion": "2.0",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "13260682214751199157"
+            }
+          },
+          "parameters": {
+            "openAIResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the existing Azure OpenAI / Cognitive Services resource"
+              }
+            },
+            "principalIds": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              },
+              "metadata": {
+                "description": "Principal IDs of the managed identities to assign the role to"
+              }
+            }
+          },
+          "variables": {
+            "roleDefinitionId": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
+          },
+          "resources": {
+            "openAIResource": {
+              "existing": true,
+              "type": "Microsoft.CognitiveServices/accounts",
+              "apiVersion": "2024-10-01",
+              "name": "[last(split(parameters('openAIResourceId'), '/'))]"
+            },
+            "roleAssignment": {
+              "copy": {
+                "name": "roleAssignment",
+                "count": "[length(parameters('principalIds'))]"
+              },
+              "type": "Microsoft.Authorization/roleAssignments",
+              "apiVersion": "2022-04-01",
+              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('openAIResourceId'), '/')))]",
+              "name": "[guid(parameters('openAIResourceId'), variables('roleDefinitionId'), parameters('principalIds')[copyIndex()])]",
+              "properties": {
+                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionId'))]",
+                "principalId": "[parameters('principalIds')[copyIndex()]]",
+                "principalType": "ServicePrincipal"
+              }
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "userAssignedIdentity"
+      ]
+    },
+    "caeDnsZone": {
+      "condition": "[variables('isAILZIntegrated')]",
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('cae-dns-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "caeDefaultDomain": {
+            "value": "[reference('containerAppsEnvironment').outputs.defaultDomain.value]"
+          },
+          "caeStaticIp": {
+            "value": "[reference('containerAppsEnvironment').outputs.staticIp.value]"
+          },
+          "vnetResourceId": {
+            "value": "[parameters('existingVnetResourceId')]"
+          },
+          "tags": {
+            "value": "[variables('tags')]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "4227343491510839529"
+            }
+          },
+          "parameters": {
+            "caeDefaultDomain": {
+              "type": "string",
+              "metadata": {
+                "description": "The default domain of the Container Apps Environment (e.g. ambitiousdesert-f1f7e820.eastus.azurecontainerapps.io)"
+              }
+            },
+            "caeStaticIp": {
+              "type": "string",
+              "metadata": {
+                "description": "The static IP of the Container Apps Environment"
+              }
+            },
+            "vnetResourceId": {
+              "type": "string",
+              "metadata": {
+                "description": "Resource ID of the VNet to link the DNS zone to"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags for resources"
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Network/privateDnsZones",
+              "apiVersion": "2024-06-01",
+              "name": "[parameters('caeDefaultDomain')]",
+              "location": "global",
+              "tags": "[parameters('tags')]"
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/A",
+              "apiVersion": "2024-06-01",
+              "name": "[format('{0}/{1}', parameters('caeDefaultDomain'), '*')]",
+              "properties": {
+                "ttl": 300,
+                "aRecords": [
+                  {
+                    "ipv4Address": "[parameters('caeStaticIp')]"
+                  }
+                ]
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/A",
+              "apiVersion": "2024-06-01",
+              "name": "[format('{0}/{1}', parameters('caeDefaultDomain'), '@')]",
+              "properties": {
+                "ttl": 300,
+                "aRecords": [
+                  {
+                    "ipv4Address": "[parameters('caeStaticIp')]"
+                  }
+                ]
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
+              ]
+            },
+            {
+              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
+              "apiVersion": "2024-06-01",
+              "name": "[format('{0}/{1}', parameters('caeDefaultDomain'), format('{0}-cae-link', last(split(parameters('vnetResourceId'), '/'))))]",
+              "location": "global",
+              "tags": "[parameters('tags')]",
+              "properties": {
+                "virtualNetwork": {
+                  "id": "[parameters('vnetResourceId')]"
+                },
+                "registrationEnabled": false
+              },
+              "dependsOn": [
+                "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
+              ]
+            }
+          ],
+          "outputs": {
+            "dnsZoneId": {
+              "type": "string",
+              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
+            },
+            "dnsZoneName": {
+              "type": "string",
+              "value": "[parameters('caeDefaultDomain')]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "containerAppsEnvironment"
+      ]
+    },
+    "apiContainerApp": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('ca-api-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('apiContainerAppName')]"
+          },
+          "location": {
+            "value": "[reference('containerAppsEnvironment').outputs.location.value]"
+          },
+          "containerAppsEnvId": {
+            "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
+          },
+          "containerRegistryServer": {
+            "value": "[reference('containerRegistry').outputs.loginServer.value]"
+          },
+          "managedIdentityId": {
+            "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
+          },
+          "targetPort": {
+            "value": 8090
+          },
+          "externalIngress": {
+            "value": true
+          },
+          "corsEnabled": {
+            "value": true
+          },
+          "livenessProbePath": {
+            "value": ""
+          },
+          "cpuCores": {
+            "value": 2
+          },
+          "memoryInGB": {
+            "value": "4Gi"
+          },
+          "minReplicas": {
+            "value": 0
+          },
+          "maxReplicas": {
+            "value": 2
+          },
+          "environmentVariables": {
+            "value": [
+              {
+                "name": "AZURE_APP_CONFIG_ENDPOINT",
+                "value": "[reference('appConfigStore').outputs.endpoint.value]"
+              },
+              {
+                "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
+                "value": "[if(not(empty(parameters('existingAppInsightsId'))), reference(parameters('existingAppInsightsId'), '2020-02-02').ConnectionString, if(variables('shouldCreateAppInsights'), reference('appInsights').outputs.connectionString.value, ''))]"
+              },
+              {
+                "name": "AZURE_CLIENT_ID",
+                "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
+              },
+              {
+                "name": "WORKER_ENGINE_API_ENDPOINT",
+                "value": "[format('https://{0}', reference('workerContainerApp').outputs.fqdn.value)]"
+              },
+              {
+                "name": "AZURE_STORAGE_ACCOUNT_NAME",
+                "value": "[variables('storageAccountName')]"
+              },
+              {
+                "name": "AZURE_CONTENT_UNDERSTANDING_ENDPOINT",
+                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
+              },
+              {
+                "name": "AZURE_OPENAI_ENDPOINT",
+                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
+              }
+            ]
+          },
+          "tags": {
+            "value": "[union(variables('tags'), createObject('azd-service-name', 'api'))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "2552967140578694385"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the container app"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location for the container app"
+              }
+            },
+            "containerAppsEnvId": {
+              "type": "string",
+              "metadata": {
+                "description": "Container Apps Environment ID"
+              }
+            },
+            "containerRegistryServer": {
+              "type": "string",
+              "metadata": {
+                "description": "Container Registry server"
+              }
+            },
+            "managedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity Resource ID"
+              }
+            },
+            "targetPort": {
+              "type": "int",
+              "metadata": {
+                "description": "Target port for the container"
+              }
+            },
+            "externalIngress": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable external ingress. Defaults to true."
+              }
+            },
+            "corsEnabled": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable CORS. Defaults to true."
+              }
+            },
+            "cpuCores": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "CPU cores for the container. Defaults to 1."
+              }
+            },
+            "memoryInGB": {
+              "type": "string",
+              "defaultValue": "2Gi",
+              "metadata": {
+                "description": "Memory in GB for the container. Defaults to 2Gi."
+              }
+            },
+            "livenessProbePath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Liveness probe path. Leave empty to disable liveness probe. Defaults to /health."
+              }
+            },
+            "minReplicas": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Minimum number of replicas for scaling. Defaults to 1."
+              }
+            },
+            "maxReplicas": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "Maximum number of replicas for scaling. Defaults to 2."
+              }
+            },
+            "environmentVariables": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Environment variables"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to resources"
+              }
+            },
+            "containerImage": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning)."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}.containerApp', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "environmentResourceId": {
+                    "value": "[parameters('containerAppsEnvId')]"
+                  },
+                  "corsPolicy": "[if(parameters('corsEnabled'), createObject('value', createObject('allowedOrigins', createArray('*'), 'allowedMethods', createArray('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'), 'allowedHeaders', createArray('*'), 'exposeHeaders', createArray('*'), 'maxAge', 3600, 'allowCredentials', true())), createObject('value', null()))]",
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "[parameters('name')]",
+                        "image": "[if(not(empty(parameters('containerImage'))), parameters('containerImage'), 'mcr.microsoft.com/k8se/quickstart:latest')]",
+                        "resources": {
+                          "cpu": "[parameters('cpuCores')]",
+                          "memory": "[parameters('memoryInGB')]"
+                        },
+                        "env": "[parameters('environmentVariables')]",
+                        "probes": "[if(not(empty(parameters('livenessProbePath'))), createArray(createObject('type', 'Liveness', 'httpGet', createObject('path', parameters('livenessProbePath'), 'port', parameters('targetPort')), 'initialDelaySeconds', 5, 'periodSeconds', 60)), createArray())]"
+                      }
+                    ]
+                  },
+                  "ingressAllowInsecure": {
+                    "value": false
+                  },
+                  "ingressExternal": {
+                    "value": "[parameters('externalIngress')]"
+                  },
+                  "ingressTargetPort": {
+                    "value": "[parameters('targetPort')]"
+                  },
+                  "ingressTransport": {
+                    "value": "auto"
+                  },
+                  "activeRevisionsMode": {
+                    "value": "Single"
+                  },
+                  "managedIdentities": {
+                    "value": {
+                      "userAssignedResourceIds": [
+                        "[parameters('managedIdentityId')]"
+                      ]
+                    }
+                  },
+                  "registries": {
+                    "value": [
+                      {
+                        "server": "[parameters('containerRegistryServer')]",
+                        "identity": "[parameters('managedIdentityId')]"
+                      }
+                    ]
+                  },
+                  "scaleSettings": {
+                    "value": {
+                      "minReplicas": "[parameters('minReplicas')]",
+                      "maxReplicas": "[parameters('maxReplicas')]",
+                      "rules": "[if(greater(parameters('maxReplicas'), 1), createArray(createObject('name', 'http-scaler', 'http', createObject('metadata', createObject('concurrentRequests', '10')))), createArray())]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.38.33.27573",
+                      "templateHash": "7056981135113238663"
+                    },
+                    "name": "Container Apps",
+                    "description": "This module deploys a Container App."
+                  },
+                  "definitions": {
+                    "ingressPortMappingType": {
+                      "type": "object",
+                      "properties": {
+                        "exposedPort": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
+                          }
+                        },
+                        "external": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Specifies whether the app port is accessible outside of the environment."
+                          }
+                        },
+                        "targetPort": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Specifies the port the container listens on."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an ingress port mapping."
+                      }
+                    },
+                    "serviceBindingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the service."
+                          }
+                        },
+                        "serviceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service ID."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a service binding."
+                      }
+                    },
+                    "environmentVarType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Environment variable name."
+                          }
+                        },
+                        "secretRef": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Non-secret environment variable value."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an environment variable."
+                      }
+                    },
+                    "containerAppProbeType": {
+                      "type": "object",
+                      "properties": {
+                        "failureThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
+                          }
+                        },
+                        "httpGet": {
+                          "$ref": "#/definitions/containerAppProbeHttpGetType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTPGet specifies the http request to perform."
+                          }
+                        },
+                        "initialDelaySeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 60,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
+                          }
+                        },
+                        "periodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
+                          }
+                        },
+                        "successThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
+                          }
+                        },
+                        "tcpSocket": {
+                          "$ref": "#/definitions/containerAppProbeTcpSocketType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
+                          }
+                        },
+                        "terminationGracePeriodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
+                          }
+                        },
+                        "timeoutSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Liveness",
+                            "Readiness",
+                            "Startup"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The type of probe."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe."
+                      }
+                    },
+                    "corsPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "allowCredentials": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Switch to determine whether the resource allows credentials."
+                          }
+                        },
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-headers header."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-methods header."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-origins header."
+                          }
+                        },
+                        "exposeHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-expose-headers header."
+                          }
+                        },
+                        "maxAge": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-max-age header."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a CORS policy."
+                      }
+                    },
+                    "containerAppProbeHttpGetType": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
+                          }
+                        },
+                        "httpHeaders": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTP headers to set in the request."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path to access on the HTTP server."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Name or number of the port to access on the container."
+                          }
+                        },
+                        "scheme": {
+                          "type": "string",
+                          "allowedValues": [
+                            "HTTP",
+                            "HTTPS"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe HTTP GET."
+                      }
+                    },
+                    "containerAppProbeHttpGetHeadersItemType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the header."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Value of the header."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe HTTP GET header."
+                      }
+                    },
+                    "containerAppProbeTcpSocketType": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to, defaults to the pod IP."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "minValue": 1,
+                          "maxValue": 65535,
+                          "metadata": {
+                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe TCP socket."
+                      }
+                    },
+                    "scaleType": {
+                      "type": "object",
+                      "properties": {
+                        "maxReplicas": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The maximum number of replicas."
+                          }
+                        },
+                        "minReplicas": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The minimum number of replicas."
+                          }
+                        },
+                        "cooldownPeriod": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The cooldown period in seconds."
+                          }
+                        },
+                        "pollingInterval": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The polling interval in seconds."
+                          }
+                        },
+                        "rules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/scaleRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The scaling rules."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The scale settings for the Container App."
+                      }
+                    },
+                    "scaleRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the scaling rule."
+                          }
+                        },
+                        "custom": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom scaling rule."
+                          }
+                        },
+                        "azureQueue": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Azure Queue based scaling rule."
+                          }
+                        },
+                        "http": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The HTTP requests based scaling rule."
+                          }
+                        },
+                        "tcp": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TCP based scaling rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The scaling rules for the Container App."
+                      }
+                    },
+                    "volumeMountType": {
+                      "type": "object",
+                      "properties": {
+                        "mountPath": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
+                          }
+                        },
+                        "subPath": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
+                          }
+                        },
+                        "volumeName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. This must match the Name of a Volume."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a volume mount."
+                      }
+                    },
+                    "secretType": {
+                      "type": "object",
+                      "properties": {
+                        "identity": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
+                          }
+                        },
+                        "keyVaultUrl": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the container app secret."
+                          }
+                        },
+                        "value": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a secret."
+                      }
+                    },
+                    "authConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "encryptionSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
+                            },
+                            "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "globalValidation": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
+                            },
+                            "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "httpSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
+                            },
+                            "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "identityProviders": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
+                            },
+                            "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "login": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
+                            },
+                            "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "platform": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
+                            },
+                            "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the container app's authentication configuration."
+                      }
+                    },
+                    "diagnosticSettingMetricsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container App."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "containerapps",
+                      "allowedValues": [
+                        "containerapps",
+                        "workflowapp",
+                        "functionapp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Metadata used to render different experiences for resources of the same type."
+                      }
+                    },
+                    "disableIngress": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Bool to disable all ingress traffic for the container app."
+                      }
+                    },
+                    "ingressExternal": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
+                      }
+                    },
+                    "clientCertificateMode": {
+                      "type": "string",
+                      "defaultValue": "ignore",
+                      "allowedValues": [
+                        "accept",
+                        "ignore",
+                        "require"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Client certificate mode for mTLS."
+                      }
+                    },
+                    "corsPolicy": {
+                      "$ref": "#/definitions/corsPolicyType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Object userd to configure CORS policy."
+                      }
+                    },
+                    "stickySessionsAffinity": {
+                      "type": "string",
+                      "defaultValue": "none",
+                      "allowedValues": [
+                        "none",
+                        "sticky"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
+                      }
+                    },
+                    "ingressTransport": {
+                      "type": "string",
+                      "defaultValue": "auto",
+                      "allowedValues": [
+                        "auto",
+                        "http",
+                        "http2",
+                        "tcp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ingress transport protocol."
+                      }
+                    },
+                    "service": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/service"
+                        },
+                        "description": "Optional. Dev ContainerApp service type."
+                      },
+                      "nullable": true
+                    },
+                    "includeAddOns": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Toggle to include the service configuration."
+                      }
+                    },
+                    "additionalPortMappings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ingressPortMappingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Settings to expose additional ports on container app."
+                      }
+                    },
+                    "ingressAllowInsecure": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
+                      }
+                    },
+                    "ingressTargetPort": {
+                      "type": "int",
+                      "defaultValue": 80,
+                      "metadata": {
+                        "description": "Optional. Target Port in containers for traffic from ingress."
+                      }
+                    },
+                    "scaleSettings": {
+                      "$ref": "#/definitions/scaleType",
+                      "defaultValue": {
+                        "maxReplicas": 10,
+                        "minReplicas": 3
+                      },
+                      "metadata": {
+                        "description": "Optional. The scaling settings of the service."
+                      }
+                    },
+                    "serviceBinds": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/serviceBindingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of container app services bound to the app."
+                      }
+                    },
+                    "activeRevisionsMode": {
+                      "type": "string",
+                      "defaultValue": "Single",
+                      "allowedValues": [
+                        "Multiple",
+                        "Single"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Controls how active revisions are handled for the Container app."
+                      }
+                    },
+                    "environmentResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of environment."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "registries": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/registries"
+                        },
+                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "customDomains": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/customDomains"
+                        },
+                        "description": "Optional. Custom domain bindings for Container App hostnames."
+                      },
+                      "nullable": true
+                    },
+                    "exposedPort": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
+                      }
+                    },
+                    "ipSecurityRestrictions": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/ipSecurityRestrictions"
+                        },
+                        "description": "Optional. Rules to restrict incoming IP address."
+                      },
+                      "nullable": true
+                    },
+                    "trafficLabel": {
+                      "type": "string",
+                      "defaultValue": "label-1",
+                      "metadata": {
+                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
+                      }
+                    },
+                    "trafficLatestRevision": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
+                      }
+                    },
+                    "trafficRevisionName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Name of a revision."
+                      }
+                    },
+                    "trafficWeight": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "metadata": {
+                        "description": "Optional. Traffic weight assigned to a revision."
+                      }
+                    },
+                    "dapr": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/dapr"
+                        },
+                        "description": "Optional. Dapr configuration for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "identitySettings": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/identitySettings"
+                        },
+                        "description": "Optional. Settings for Managed Identities that are assigned to the Container App. If a Managed Identity is not specified here, default settings will be used."
+                      },
+                      "nullable": true
+                    },
+                    "maxInactiveRevisions": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Max inactive revisions a Container App can have."
+                      }
+                    },
+                    "runtime": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/runtime"
+                        },
+                        "description": "Optional. Runtime configuration for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "containers": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/containers"
+                        },
+                        "description": "Required. List of container definitions for the Container App."
+                      }
+                    },
+                    "terminationGracePeriodSeconds": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The termination grace period for the container app."
+                      }
+                    },
+                    "initContainersTemplate": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/initContainers"
+                        },
+                        "description": "Optional. List of specialized containers that run before app containers."
+                      },
+                      "nullable": true
+                    },
+                    "secrets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The secrets of the Container App."
+                      }
+                    },
+                    "revisionSuffix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. User friendly suffix that is appended to the revision name."
+                      }
+                    },
+                    "volumes": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/volumes"
+                        },
+                        "description": "Optional. List of volume definitions for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "workloadProfileName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Workload profile name to pin for container app execution."
+                      }
+                    },
+                    "authConfig": {
+                      "$ref": "#/definitions/authConfigType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the Container App Auth configs."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "containerApp": {
+                      "type": "Microsoft.App/containerApps",
+                      "apiVersion": "2025-02-02-preview",
+                      "name": "[parameters('name')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "environmentId": "[parameters('environmentResourceId')]",
+                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                        "template": {
+                          "containers": "[parameters('containers')]",
+                          "terminationGracePeriodSeconds": "[parameters('terminationGracePeriodSeconds')]",
+                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
+                          "revisionSuffix": "[parameters('revisionSuffix')]",
+                          "scale": "[parameters('scaleSettings')]",
+                          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
+                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
+                        },
+                        "configuration": {
+                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
+                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
+                          "identitySettings": "[if(not(empty(parameters('identitySettings'))), parameters('identitySettings'), null())]",
+                          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
+                          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
+                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
+                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
+                          "secrets": "[parameters('secrets')]",
+                          "runtime": "[if(not(empty(parameters('runtime'))), parameters('runtime'), null())]"
+                        }
+                      }
+                    },
+                    "containerApp_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_roleAssignments": {
+                      "copy": {
+                        "name": "containerApp_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_diagnosticSettings": {
+                      "copy": {
+                        "name": "containerApp_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerAppAuthConfigs": {
+                      "condition": "[not(empty(parameters('authConfig')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-auth-config', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "containerAppName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "encryptionSettings": {
+                            "value": "[tryGet(parameters('authConfig'), 'encryptionSettings')]"
+                          },
+                          "globalValidation": {
+                            "value": "[tryGet(parameters('authConfig'), 'globalValidation')]"
+                          },
+                          "httpSettings": {
+                            "value": "[tryGet(parameters('authConfig'), 'httpSettings')]"
+                          },
+                          "identityProviders": {
+                            "value": "[tryGet(parameters('authConfig'), 'identityProviders')]"
+                          },
+                          "login": {
+                            "value": "[tryGet(parameters('authConfig'), 'login')]"
+                          },
+                          "platform": {
+                            "value": "[tryGet(parameters('authConfig'), 'platform')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "12480411243596309951"
+                            },
+                            "name": "Container App Auth Configs",
+                            "description": "This module deploys Container App Auth Configs."
+                          },
+                          "parameters": {
+                            "containerAppName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Container App. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "encryptionSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
+                                },
+                                "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "globalValidation": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
+                                },
+                                "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "httpSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
+                                },
+                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "identityProviders": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
+                                },
+                                "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "login": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
+                                },
+                                "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "platform": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
+                                },
+                                "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "containerApp": {
+                              "existing": true,
+                              "type": "Microsoft.App/containerApps",
+                              "apiVersion": "2025-02-02-preview",
+                              "name": "[parameters('containerAppName')]"
+                            },
+                            "containerAppAuthConfigs": {
+                              "type": "Microsoft.App/containerApps/authConfigs",
+                              "apiVersion": "2025-02-02-preview",
+                              "name": "[format('{0}/{1}', parameters('containerAppName'), 'current')]",
+                              "properties": {
+                                "encryptionSettings": "[parameters('encryptionSettings')]",
+                                "globalValidation": "[parameters('globalValidation')]",
+                                "httpSettings": "[parameters('httpSettings')]",
+                                "identityProviders": "[parameters('identityProviders')]",
+                                "login": "[parameters('login')]",
+                                "platform": "[parameters('platform')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the set of Container App Auth configs."
+                              },
+                              "value": "current"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the set of Container App Auth configs."
+                              },
+                              "value": "[resourceId('Microsoft.App/containerApps/authConfigs', parameters('containerAppName'), 'current')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group containing the set of Container App Auth configs."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Container App."
+                      },
+                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
+                    },
+                    "fqdn": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The configuration of ingress fqdn."
+                      },
+                      "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Container App was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Container App."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('containerApp', '2025-02-02-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('containerApp', '2025-02-02-preview', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "value": "[format('{0}.containerApp', deployment().name)]"
+            },
+            "fqdn": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.fqdn.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "aiFoundry",
+        "appConfigStore",
+        "appInsights",
+        "containerAppsEnvironment",
+        "containerRegistry",
+        "userAssignedIdentity",
+        "workerContainerApp"
+      ]
+    },
+    "workerContainerApp": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('ca-worker-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('workerContainerAppName')]"
+          },
+          "location": {
+            "value": "[reference('containerAppsEnvironment').outputs.location.value]"
+          },
+          "containerAppsEnvId": {
+            "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
+          },
+          "containerRegistryServer": {
+            "value": "[reference('containerRegistry').outputs.loginServer.value]"
+          },
+          "managedIdentityId": {
+            "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
+          },
+          "targetPort": {
+            "value": "[parameters('workerContainerAppTargetPort')]"
+          },
+          "externalIngress": {
+            "value": true
+          },
+          "corsEnabled": {
+            "value": true
+          },
+          "livenessProbePath": {
+            "value": ""
+          },
+          "cpuCores": {
+            "value": 2
+          },
+          "memoryInGB": {
+            "value": "4Gi"
+          },
+          "minReplicas": {
+            "value": 0
+          },
+          "maxReplicas": {
+            "value": 3
+          },
+          "environmentVariables": {
+            "value": [
+              {
+                "name": "AZURE_APP_CONFIG_ENDPOINT",
+                "value": "[reference('appConfigStore').outputs.endpoint.value]"
+              },
+              {
+                "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
+                "value": "[if(not(empty(parameters('existingAppInsightsId'))), reference(parameters('existingAppInsightsId'), '2020-02-02').ConnectionString, if(variables('shouldCreateAppInsights'), reference('appInsights').outputs.connectionString.value, ''))]"
+              },
+              {
+                "name": "AZURE_CLIENT_ID",
+                "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
+              },
+              {
+                "name": "AZURE_STORAGE_ACCOUNT_NAME",
+                "value": "[variables('storageAccountName')]"
+              },
+              {
+                "name": "AZURE_CONTENT_UNDERSTANDING_ENDPOINT",
+                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
+              },
+              {
+                "name": "AZURE_OPENAI_ENDPOINT",
+                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
+              }
+            ]
+          },
+          "tags": {
+            "value": "[union(variables('tags'), createObject('azd-service-name', 'worker'))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "2552967140578694385"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the container app"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location for the container app"
+              }
+            },
+            "containerAppsEnvId": {
+              "type": "string",
+              "metadata": {
+                "description": "Container Apps Environment ID"
+              }
+            },
+            "containerRegistryServer": {
+              "type": "string",
+              "metadata": {
+                "description": "Container Registry server"
+              }
+            },
+            "managedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity Resource ID"
+              }
+            },
+            "targetPort": {
+              "type": "int",
+              "metadata": {
+                "description": "Target port for the container"
+              }
+            },
+            "externalIngress": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable external ingress. Defaults to true."
+              }
+            },
+            "corsEnabled": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable CORS. Defaults to true."
+              }
+            },
+            "cpuCores": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "CPU cores for the container. Defaults to 1."
+              }
+            },
+            "memoryInGB": {
+              "type": "string",
+              "defaultValue": "2Gi",
+              "metadata": {
+                "description": "Memory in GB for the container. Defaults to 2Gi."
+              }
+            },
+            "livenessProbePath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Liveness probe path. Leave empty to disable liveness probe. Defaults to /health."
+              }
+            },
+            "minReplicas": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Minimum number of replicas for scaling. Defaults to 1."
+              }
+            },
+            "maxReplicas": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "Maximum number of replicas for scaling. Defaults to 2."
+              }
+            },
+            "environmentVariables": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Environment variables"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to resources"
+              }
+            },
+            "containerImage": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning)."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}.containerApp', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "environmentResourceId": {
+                    "value": "[parameters('containerAppsEnvId')]"
+                  },
+                  "corsPolicy": "[if(parameters('corsEnabled'), createObject('value', createObject('allowedOrigins', createArray('*'), 'allowedMethods', createArray('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'), 'allowedHeaders', createArray('*'), 'exposeHeaders', createArray('*'), 'maxAge', 3600, 'allowCredentials', true())), createObject('value', null()))]",
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "[parameters('name')]",
+                        "image": "[if(not(empty(parameters('containerImage'))), parameters('containerImage'), 'mcr.microsoft.com/k8se/quickstart:latest')]",
+                        "resources": {
+                          "cpu": "[parameters('cpuCores')]",
+                          "memory": "[parameters('memoryInGB')]"
+                        },
+                        "env": "[parameters('environmentVariables')]",
+                        "probes": "[if(not(empty(parameters('livenessProbePath'))), createArray(createObject('type', 'Liveness', 'httpGet', createObject('path', parameters('livenessProbePath'), 'port', parameters('targetPort')), 'initialDelaySeconds', 5, 'periodSeconds', 60)), createArray())]"
+                      }
+                    ]
+                  },
+                  "ingressAllowInsecure": {
+                    "value": false
+                  },
+                  "ingressExternal": {
+                    "value": "[parameters('externalIngress')]"
+                  },
+                  "ingressTargetPort": {
+                    "value": "[parameters('targetPort')]"
+                  },
+                  "ingressTransport": {
+                    "value": "auto"
+                  },
+                  "activeRevisionsMode": {
+                    "value": "Single"
+                  },
+                  "managedIdentities": {
+                    "value": {
+                      "userAssignedResourceIds": [
+                        "[parameters('managedIdentityId')]"
+                      ]
+                    }
+                  },
+                  "registries": {
+                    "value": [
+                      {
+                        "server": "[parameters('containerRegistryServer')]",
+                        "identity": "[parameters('managedIdentityId')]"
+                      }
+                    ]
+                  },
+                  "scaleSettings": {
+                    "value": {
+                      "minReplicas": "[parameters('minReplicas')]",
+                      "maxReplicas": "[parameters('maxReplicas')]",
+                      "rules": "[if(greater(parameters('maxReplicas'), 1), createArray(createObject('name', 'http-scaler', 'http', createObject('metadata', createObject('concurrentRequests', '10')))), createArray())]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.38.33.27573",
+                      "templateHash": "7056981135113238663"
+                    },
+                    "name": "Container Apps",
+                    "description": "This module deploys a Container App."
+                  },
+                  "definitions": {
+                    "ingressPortMappingType": {
+                      "type": "object",
+                      "properties": {
+                        "exposedPort": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
+                          }
+                        },
+                        "external": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Specifies whether the app port is accessible outside of the environment."
+                          }
+                        },
+                        "targetPort": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Specifies the port the container listens on."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an ingress port mapping."
+                      }
+                    },
+                    "serviceBindingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the service."
+                          }
+                        },
+                        "serviceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service ID."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a service binding."
+                      }
+                    },
+                    "environmentVarType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Environment variable name."
+                          }
+                        },
+                        "secretRef": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Non-secret environment variable value."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an environment variable."
+                      }
+                    },
+                    "containerAppProbeType": {
+                      "type": "object",
+                      "properties": {
+                        "failureThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
+                          }
+                        },
+                        "httpGet": {
+                          "$ref": "#/definitions/containerAppProbeHttpGetType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTPGet specifies the http request to perform."
+                          }
+                        },
+                        "initialDelaySeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 60,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
+                          }
+                        },
+                        "periodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
+                          }
+                        },
+                        "successThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
+                          }
+                        },
+                        "tcpSocket": {
+                          "$ref": "#/definitions/containerAppProbeTcpSocketType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
+                          }
+                        },
+                        "terminationGracePeriodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
+                          }
+                        },
+                        "timeoutSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Liveness",
+                            "Readiness",
+                            "Startup"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The type of probe."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe."
+                      }
+                    },
+                    "corsPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "allowCredentials": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Switch to determine whether the resource allows credentials."
+                          }
+                        },
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-headers header."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-methods header."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-origins header."
+                          }
+                        },
+                        "exposeHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-expose-headers header."
+                          }
+                        },
+                        "maxAge": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-max-age header."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a CORS policy."
+                      }
+                    },
+                    "containerAppProbeHttpGetType": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
+                          }
+                        },
+                        "httpHeaders": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTP headers to set in the request."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path to access on the HTTP server."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Name or number of the port to access on the container."
+                          }
+                        },
+                        "scheme": {
+                          "type": "string",
+                          "allowedValues": [
+                            "HTTP",
+                            "HTTPS"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe HTTP GET."
+                      }
+                    },
+                    "containerAppProbeHttpGetHeadersItemType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the header."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Value of the header."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe HTTP GET header."
+                      }
+                    },
+                    "containerAppProbeTcpSocketType": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to, defaults to the pod IP."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "minValue": 1,
+                          "maxValue": 65535,
+                          "metadata": {
+                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe TCP socket."
+                      }
+                    },
+                    "scaleType": {
+                      "type": "object",
+                      "properties": {
+                        "maxReplicas": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The maximum number of replicas."
+                          }
+                        },
+                        "minReplicas": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The minimum number of replicas."
+                          }
+                        },
+                        "cooldownPeriod": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The cooldown period in seconds."
+                          }
+                        },
+                        "pollingInterval": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The polling interval in seconds."
+                          }
+                        },
+                        "rules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/scaleRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The scaling rules."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The scale settings for the Container App."
+                      }
+                    },
+                    "scaleRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the scaling rule."
+                          }
+                        },
+                        "custom": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom scaling rule."
+                          }
+                        },
+                        "azureQueue": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Azure Queue based scaling rule."
+                          }
+                        },
+                        "http": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The HTTP requests based scaling rule."
+                          }
+                        },
+                        "tcp": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TCP based scaling rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The scaling rules for the Container App."
+                      }
+                    },
+                    "volumeMountType": {
+                      "type": "object",
+                      "properties": {
+                        "mountPath": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
+                          }
+                        },
+                        "subPath": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
+                          }
+                        },
+                        "volumeName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. This must match the Name of a Volume."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a volume mount."
+                      }
+                    },
+                    "secretType": {
+                      "type": "object",
+                      "properties": {
+                        "identity": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
+                          }
+                        },
+                        "keyVaultUrl": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the container app secret."
+                          }
+                        },
+                        "value": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a secret."
+                      }
+                    },
+                    "authConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "encryptionSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
+                            },
+                            "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "globalValidation": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
+                            },
+                            "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "httpSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
+                            },
+                            "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "identityProviders": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
+                            },
+                            "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "login": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
+                            },
+                            "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "platform": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
+                            },
+                            "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the container app's authentication configuration."
+                      }
+                    },
+                    "diagnosticSettingMetricsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container App."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "containerapps",
+                      "allowedValues": [
+                        "containerapps",
+                        "workflowapp",
+                        "functionapp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Metadata used to render different experiences for resources of the same type."
+                      }
+                    },
+                    "disableIngress": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Bool to disable all ingress traffic for the container app."
+                      }
+                    },
+                    "ingressExternal": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
+                      }
+                    },
+                    "clientCertificateMode": {
+                      "type": "string",
+                      "defaultValue": "ignore",
+                      "allowedValues": [
+                        "accept",
+                        "ignore",
+                        "require"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Client certificate mode for mTLS."
+                      }
+                    },
+                    "corsPolicy": {
+                      "$ref": "#/definitions/corsPolicyType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Object userd to configure CORS policy."
+                      }
+                    },
+                    "stickySessionsAffinity": {
+                      "type": "string",
+                      "defaultValue": "none",
+                      "allowedValues": [
+                        "none",
+                        "sticky"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
+                      }
+                    },
+                    "ingressTransport": {
+                      "type": "string",
+                      "defaultValue": "auto",
+                      "allowedValues": [
+                        "auto",
+                        "http",
+                        "http2",
+                        "tcp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ingress transport protocol."
+                      }
+                    },
+                    "service": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/service"
+                        },
+                        "description": "Optional. Dev ContainerApp service type."
+                      },
+                      "nullable": true
+                    },
+                    "includeAddOns": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Toggle to include the service configuration."
+                      }
+                    },
+                    "additionalPortMappings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ingressPortMappingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Settings to expose additional ports on container app."
+                      }
+                    },
+                    "ingressAllowInsecure": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
+                      }
+                    },
+                    "ingressTargetPort": {
+                      "type": "int",
+                      "defaultValue": 80,
+                      "metadata": {
+                        "description": "Optional. Target Port in containers for traffic from ingress."
+                      }
+                    },
+                    "scaleSettings": {
+                      "$ref": "#/definitions/scaleType",
+                      "defaultValue": {
+                        "maxReplicas": 10,
+                        "minReplicas": 3
+                      },
+                      "metadata": {
+                        "description": "Optional. The scaling settings of the service."
+                      }
+                    },
+                    "serviceBinds": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/serviceBindingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of container app services bound to the app."
+                      }
+                    },
+                    "activeRevisionsMode": {
+                      "type": "string",
+                      "defaultValue": "Single",
+                      "allowedValues": [
+                        "Multiple",
+                        "Single"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Controls how active revisions are handled for the Container app."
+                      }
+                    },
+                    "environmentResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of environment."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "registries": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/registries"
+                        },
+                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "customDomains": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/customDomains"
+                        },
+                        "description": "Optional. Custom domain bindings for Container App hostnames."
+                      },
+                      "nullable": true
+                    },
+                    "exposedPort": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
+                      }
+                    },
+                    "ipSecurityRestrictions": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/ipSecurityRestrictions"
+                        },
+                        "description": "Optional. Rules to restrict incoming IP address."
+                      },
+                      "nullable": true
+                    },
+                    "trafficLabel": {
+                      "type": "string",
+                      "defaultValue": "label-1",
+                      "metadata": {
+                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
+                      }
+                    },
+                    "trafficLatestRevision": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
+                      }
+                    },
+                    "trafficRevisionName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Name of a revision."
+                      }
+                    },
+                    "trafficWeight": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "metadata": {
+                        "description": "Optional. Traffic weight assigned to a revision."
+                      }
+                    },
+                    "dapr": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/dapr"
+                        },
+                        "description": "Optional. Dapr configuration for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "identitySettings": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/identitySettings"
+                        },
+                        "description": "Optional. Settings for Managed Identities that are assigned to the Container App. If a Managed Identity is not specified here, default settings will be used."
+                      },
+                      "nullable": true
+                    },
+                    "maxInactiveRevisions": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Max inactive revisions a Container App can have."
+                      }
+                    },
+                    "runtime": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/runtime"
+                        },
+                        "description": "Optional. Runtime configuration for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "containers": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/containers"
+                        },
+                        "description": "Required. List of container definitions for the Container App."
+                      }
+                    },
+                    "terminationGracePeriodSeconds": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The termination grace period for the container app."
+                      }
+                    },
+                    "initContainersTemplate": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/initContainers"
+                        },
+                        "description": "Optional. List of specialized containers that run before app containers."
+                      },
+                      "nullable": true
+                    },
+                    "secrets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The secrets of the Container App."
+                      }
+                    },
+                    "revisionSuffix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. User friendly suffix that is appended to the revision name."
+                      }
+                    },
+                    "volumes": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/volumes"
+                        },
+                        "description": "Optional. List of volume definitions for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "workloadProfileName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Workload profile name to pin for container app execution."
+                      }
+                    },
+                    "authConfig": {
+                      "$ref": "#/definitions/authConfigType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the Container App Auth configs."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "containerApp": {
+                      "type": "Microsoft.App/containerApps",
+                      "apiVersion": "2025-02-02-preview",
+                      "name": "[parameters('name')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "environmentId": "[parameters('environmentResourceId')]",
+                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                        "template": {
+                          "containers": "[parameters('containers')]",
+                          "terminationGracePeriodSeconds": "[parameters('terminationGracePeriodSeconds')]",
+                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
+                          "revisionSuffix": "[parameters('revisionSuffix')]",
+                          "scale": "[parameters('scaleSettings')]",
+                          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
+                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
+                        },
+                        "configuration": {
+                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
+                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
+                          "identitySettings": "[if(not(empty(parameters('identitySettings'))), parameters('identitySettings'), null())]",
+                          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
+                          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
+                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
+                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
+                          "secrets": "[parameters('secrets')]",
+                          "runtime": "[if(not(empty(parameters('runtime'))), parameters('runtime'), null())]"
+                        }
+                      }
+                    },
+                    "containerApp_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_roleAssignments": {
+                      "copy": {
+                        "name": "containerApp_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_diagnosticSettings": {
+                      "copy": {
+                        "name": "containerApp_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerAppAuthConfigs": {
+                      "condition": "[not(empty(parameters('authConfig')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-auth-config', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "containerAppName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "encryptionSettings": {
+                            "value": "[tryGet(parameters('authConfig'), 'encryptionSettings')]"
+                          },
+                          "globalValidation": {
+                            "value": "[tryGet(parameters('authConfig'), 'globalValidation')]"
+                          },
+                          "httpSettings": {
+                            "value": "[tryGet(parameters('authConfig'), 'httpSettings')]"
+                          },
+                          "identityProviders": {
+                            "value": "[tryGet(parameters('authConfig'), 'identityProviders')]"
+                          },
+                          "login": {
+                            "value": "[tryGet(parameters('authConfig'), 'login')]"
+                          },
+                          "platform": {
+                            "value": "[tryGet(parameters('authConfig'), 'platform')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "12480411243596309951"
+                            },
+                            "name": "Container App Auth Configs",
+                            "description": "This module deploys Container App Auth Configs."
+                          },
+                          "parameters": {
+                            "containerAppName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Container App. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "encryptionSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
+                                },
+                                "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "globalValidation": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
+                                },
+                                "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "httpSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
+                                },
+                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "identityProviders": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
+                                },
+                                "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "login": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
+                                },
+                                "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "platform": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
+                                },
+                                "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "containerApp": {
+                              "existing": true,
+                              "type": "Microsoft.App/containerApps",
+                              "apiVersion": "2025-02-02-preview",
+                              "name": "[parameters('containerAppName')]"
+                            },
+                            "containerAppAuthConfigs": {
+                              "type": "Microsoft.App/containerApps/authConfigs",
+                              "apiVersion": "2025-02-02-preview",
+                              "name": "[format('{0}/{1}', parameters('containerAppName'), 'current')]",
+                              "properties": {
+                                "encryptionSettings": "[parameters('encryptionSettings')]",
+                                "globalValidation": "[parameters('globalValidation')]",
+                                "httpSettings": "[parameters('httpSettings')]",
+                                "identityProviders": "[parameters('identityProviders')]",
+                                "login": "[parameters('login')]",
+                                "platform": "[parameters('platform')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the set of Container App Auth configs."
+                              },
+                              "value": "current"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the set of Container App Auth configs."
+                              },
+                              "value": "[resourceId('Microsoft.App/containerApps/authConfigs', parameters('containerAppName'), 'current')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group containing the set of Container App Auth configs."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Container App."
+                      },
+                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
+                    },
+                    "fqdn": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The configuration of ingress fqdn."
+                      },
+                      "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Container App was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Container App."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('containerApp', '2025-02-02-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('containerApp', '2025-02-02-preview', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "value": "[format('{0}.containerApp', deployment().name)]"
+            },
+            "fqdn": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.fqdn.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "aiFoundry",
+        "appConfigStore",
+        "appInsights",
+        "containerAppsEnvironment",
+        "containerRegistry",
+        "userAssignedIdentity"
+      ]
+    },
+    "webContainerApp": {
+      "type": "Microsoft.Resources/deployments",
+      "apiVersion": "2025-04-01",
+      "name": "[format('ca-web-{0}', variables('resourceToken'))]",
+      "properties": {
+        "expressionEvaluationOptions": {
+          "scope": "inner"
+        },
+        "mode": "Incremental",
+        "parameters": {
+          "name": {
+            "value": "[variables('webContainerAppName')]"
+          },
+          "location": {
+            "value": "[reference('containerAppsEnvironment').outputs.location.value]"
+          },
+          "containerAppsEnvId": {
+            "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
+          },
+          "containerRegistryServer": {
+            "value": "[reference('containerRegistry').outputs.loginServer.value]"
+          },
+          "managedIdentityId": {
+            "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
+          },
+          "targetPort": {
+            "value": 8080
+          },
+          "externalIngress": {
+            "value": true
+          },
+          "corsEnabled": {
+            "value": true
+          },
+          "livenessProbePath": {
+            "value": ""
+          },
+          "cpuCores": {
+            "value": 1
+          },
+          "memoryInGB": {
+            "value": "2Gi"
+          },
+          "minReplicas": {
+            "value": 0
+          },
+          "maxReplicas": {
+            "value": 1
+          },
+          "environmentVariables": {
+            "value": [
+              {
+                "name": "VITE_API_BASE_URL",
+                "value": "[format('https://{0}/api/', reference('apiContainerApp').outputs.fqdn.value)]"
+              }
+            ]
+          },
+          "tags": {
+            "value": "[union(variables('tags'), createObject('azd-service-name', 'web'))]"
+          }
+        },
+        "template": {
+          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+          "contentVersion": "1.0.0.0",
+          "metadata": {
+            "_generator": {
+              "name": "bicep",
+              "version": "0.43.8.12551",
+              "templateHash": "2552967140578694385"
+            }
+          },
+          "parameters": {
+            "name": {
+              "type": "string",
+              "metadata": {
+                "description": "Name of the container app"
+              }
+            },
+            "location": {
+              "type": "string",
+              "metadata": {
+                "description": "Location for the container app"
+              }
+            },
+            "containerAppsEnvId": {
+              "type": "string",
+              "metadata": {
+                "description": "Container Apps Environment ID"
+              }
+            },
+            "containerRegistryServer": {
+              "type": "string",
+              "metadata": {
+                "description": "Container Registry server"
+              }
+            },
+            "managedIdentityId": {
+              "type": "string",
+              "metadata": {
+                "description": "Managed Identity Resource ID"
+              }
+            },
+            "targetPort": {
+              "type": "int",
+              "metadata": {
+                "description": "Target port for the container"
+              }
+            },
+            "externalIngress": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable external ingress. Defaults to true."
+              }
+            },
+            "corsEnabled": {
+              "type": "bool",
+              "defaultValue": true,
+              "metadata": {
+                "description": "Enable CORS. Defaults to true."
+              }
+            },
+            "cpuCores": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "CPU cores for the container. Defaults to 1."
+              }
+            },
+            "memoryInGB": {
+              "type": "string",
+              "defaultValue": "2Gi",
+              "metadata": {
+                "description": "Memory in GB for the container. Defaults to 2Gi."
+              }
+            },
+            "livenessProbePath": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Liveness probe path. Leave empty to disable liveness probe. Defaults to /health."
+              }
+            },
+            "minReplicas": {
+              "type": "int",
+              "defaultValue": 1,
+              "metadata": {
+                "description": "Minimum number of replicas for scaling. Defaults to 1."
+              }
+            },
+            "maxReplicas": {
+              "type": "int",
+              "defaultValue": 2,
+              "metadata": {
+                "description": "Maximum number of replicas for scaling. Defaults to 2."
+              }
+            },
+            "environmentVariables": {
+              "type": "array",
+              "defaultValue": [],
+              "metadata": {
+                "description": "Environment variables"
+              }
+            },
+            "tags": {
+              "type": "object",
+              "defaultValue": {},
+              "metadata": {
+                "description": "Tags to apply to resources"
+              }
+            },
+            "containerImage": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning)."
+              }
+            }
+          },
+          "resources": [
+            {
+              "type": "Microsoft.Resources/deployments",
+              "apiVersion": "2025-04-01",
+              "name": "[format('{0}.containerApp', deployment().name)]",
+              "properties": {
+                "expressionEvaluationOptions": {
+                  "scope": "inner"
+                },
+                "mode": "Incremental",
+                "parameters": {
+                  "name": {
+                    "value": "[parameters('name')]"
+                  },
+                  "location": {
+                    "value": "[parameters('location')]"
+                  },
+                  "tags": {
+                    "value": "[parameters('tags')]"
+                  },
+                  "environmentResourceId": {
+                    "value": "[parameters('containerAppsEnvId')]"
+                  },
+                  "corsPolicy": "[if(parameters('corsEnabled'), createObject('value', createObject('allowedOrigins', createArray('*'), 'allowedMethods', createArray('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'), 'allowedHeaders', createArray('*'), 'exposeHeaders', createArray('*'), 'maxAge', 3600, 'allowCredentials', true())), createObject('value', null()))]",
+                  "containers": {
+                    "value": [
+                      {
+                        "name": "[parameters('name')]",
+                        "image": "[if(not(empty(parameters('containerImage'))), parameters('containerImage'), 'mcr.microsoft.com/k8se/quickstart:latest')]",
+                        "resources": {
+                          "cpu": "[parameters('cpuCores')]",
+                          "memory": "[parameters('memoryInGB')]"
+                        },
+                        "env": "[parameters('environmentVariables')]",
+                        "probes": "[if(not(empty(parameters('livenessProbePath'))), createArray(createObject('type', 'Liveness', 'httpGet', createObject('path', parameters('livenessProbePath'), 'port', parameters('targetPort')), 'initialDelaySeconds', 5, 'periodSeconds', 60)), createArray())]"
+                      }
+                    ]
+                  },
+                  "ingressAllowInsecure": {
+                    "value": false
+                  },
+                  "ingressExternal": {
+                    "value": "[parameters('externalIngress')]"
+                  },
+                  "ingressTargetPort": {
+                    "value": "[parameters('targetPort')]"
+                  },
+                  "ingressTransport": {
+                    "value": "auto"
+                  },
+                  "activeRevisionsMode": {
+                    "value": "Single"
+                  },
+                  "managedIdentities": {
+                    "value": {
+                      "userAssignedResourceIds": [
+                        "[parameters('managedIdentityId')]"
+                      ]
+                    }
+                  },
+                  "registries": {
+                    "value": [
+                      {
+                        "server": "[parameters('containerRegistryServer')]",
+                        "identity": "[parameters('managedIdentityId')]"
+                      }
+                    ]
+                  },
+                  "scaleSettings": {
+                    "value": {
+                      "minReplicas": "[parameters('minReplicas')]",
+                      "maxReplicas": "[parameters('maxReplicas')]",
+                      "rules": "[if(greater(parameters('maxReplicas'), 1), createArray(createObject('name', 'http-scaler', 'http', createObject('metadata', createObject('concurrentRequests', '10')))), createArray())]"
+                    }
+                  }
+                },
+                "template": {
+                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                  "languageVersion": "2.0",
+                  "contentVersion": "1.0.0.0",
+                  "metadata": {
+                    "_generator": {
+                      "name": "bicep",
+                      "version": "0.38.33.27573",
+                      "templateHash": "7056981135113238663"
+                    },
+                    "name": "Container Apps",
+                    "description": "This module deploys a Container App."
+                  },
+                  "definitions": {
+                    "ingressPortMappingType": {
+                      "type": "object",
+                      "properties": {
+                        "exposedPort": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
+                          }
+                        },
+                        "external": {
+                          "type": "bool",
+                          "metadata": {
+                            "description": "Required. Specifies whether the app port is accessible outside of the environment."
+                          }
+                        },
+                        "targetPort": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Specifies the port the container listens on."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an ingress port mapping."
+                      }
+                    },
+                    "serviceBindingType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the service."
+                          }
+                        },
+                        "serviceId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The service ID."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a service binding."
+                      }
+                    },
+                    "environmentVarType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Environment variable name."
+                          }
+                        },
+                        "secretRef": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Non-secret environment variable value."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for an environment variable."
+                      }
+                    },
+                    "containerAppProbeType": {
+                      "type": "object",
+                      "properties": {
+                        "failureThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
+                          }
+                        },
+                        "httpGet": {
+                          "$ref": "#/definitions/containerAppProbeHttpGetType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTPGet specifies the http request to perform."
+                          }
+                        },
+                        "initialDelaySeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 60,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
+                          }
+                        },
+                        "periodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
+                          }
+                        },
+                        "successThreshold": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 10,
+                          "metadata": {
+                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
+                          }
+                        },
+                        "tcpSocket": {
+                          "$ref": "#/definitions/containerAppProbeTcpSocketType",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
+                          }
+                        },
+                        "terminationGracePeriodSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
+                          }
+                        },
+                        "timeoutSeconds": {
+                          "type": "int",
+                          "nullable": true,
+                          "minValue": 1,
+                          "maxValue": 240,
+                          "metadata": {
+                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
+                          }
+                        },
+                        "type": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Liveness",
+                            "Readiness",
+                            "Startup"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The type of probe."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe."
+                      }
+                    },
+                    "corsPolicyType": {
+                      "type": "object",
+                      "properties": {
+                        "allowCredentials": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Switch to determine whether the resource allows credentials."
+                          }
+                        },
+                        "allowedHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-headers header."
+                          }
+                        },
+                        "allowedMethods": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-methods header."
+                          }
+                        },
+                        "allowedOrigins": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-allow-origins header."
+                          }
+                        },
+                        "exposeHeaders": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-expose-headers header."
+                          }
+                        },
+                        "maxAge": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specifies the content for the access-control-max-age header."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a CORS policy."
+                      }
+                    },
+                    "containerAppProbeHttpGetType": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
+                          }
+                        },
+                        "httpHeaders": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. HTTP headers to set in the request."
+                          }
+                        },
+                        "path": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path to access on the HTTP server."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. Name or number of the port to access on the container."
+                          }
+                        },
+                        "scheme": {
+                          "type": "string",
+                          "allowedValues": [
+                            "HTTP",
+                            "HTTPS"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe HTTP GET."
+                      }
+                    },
+                    "containerAppProbeHttpGetHeadersItemType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Name of the header."
+                          }
+                        },
+                        "value": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Value of the header."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe HTTP GET header."
+                      }
+                    },
+                    "containerAppProbeTcpSocketType": {
+                      "type": "object",
+                      "properties": {
+                        "host": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Host name to connect to, defaults to the pod IP."
+                          }
+                        },
+                        "port": {
+                          "type": "int",
+                          "minValue": 1,
+                          "maxValue": 65535,
+                          "metadata": {
+                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a container app probe TCP socket."
+                      }
+                    },
+                    "scaleType": {
+                      "type": "object",
+                      "properties": {
+                        "maxReplicas": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The maximum number of replicas."
+                          }
+                        },
+                        "minReplicas": {
+                          "type": "int",
+                          "metadata": {
+                            "description": "Required. The minimum number of replicas."
+                          }
+                        },
+                        "cooldownPeriod": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The cooldown period in seconds."
+                          }
+                        },
+                        "pollingInterval": {
+                          "type": "int",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The polling interval in seconds."
+                          }
+                        },
+                        "rules": {
+                          "type": "array",
+                          "items": {
+                            "$ref": "#/definitions/scaleRuleType"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The scaling rules."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The scale settings for the Container App."
+                      }
+                    },
+                    "scaleRuleType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The name of the scaling rule."
+                          }
+                        },
+                        "custom": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The custom scaling rule."
+                          }
+                        },
+                        "azureQueue": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Azure Queue based scaling rule."
+                          }
+                        },
+                        "http": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The HTTP requests based scaling rule."
+                          }
+                        },
+                        "tcp": {
+                          "type": "object",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The TCP based scaling rule."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The scaling rules for the Container App."
+                      }
+                    },
+                    "volumeMountType": {
+                      "type": "object",
+                      "properties": {
+                        "mountPath": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
+                          }
+                        },
+                        "subPath": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
+                          }
+                        },
+                        "volumeName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. This must match the Name of a Volume."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "The type for a volume mount."
+                      }
+                    },
+                    "secretType": {
+                      "type": "object",
+                      "properties": {
+                        "identity": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
+                          }
+                        },
+                        "keyVaultUrl": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
+                          }
+                        },
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of the container app secret."
+                          }
+                        },
+                        "value": {
+                          "type": "securestring",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for a secret."
+                      }
+                    },
+                    "authConfigType": {
+                      "type": "object",
+                      "properties": {
+                        "encryptionSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
+                            },
+                            "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "globalValidation": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
+                            },
+                            "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "httpSettings": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
+                            },
+                            "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "identityProviders": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
+                            },
+                            "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "login": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
+                            },
+                            "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        },
+                        "platform": {
+                          "type": "object",
+                          "metadata": {
+                            "__bicep_resource_derived_type!": {
+                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
+                            },
+                            "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
+                          },
+                          "nullable": true
+                        }
+                      },
+                      "metadata": {
+                        "__bicep_export!": true,
+                        "description": "The type for the container app's authentication configuration."
+                      }
+                    },
+                    "diagnosticSettingMetricsOnlyType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of diagnostic setting."
+                          }
+                        },
+                        "metricCategories": {
+                          "type": "array",
+                          "items": {
+                            "type": "object",
+                            "properties": {
+                              "category": {
+                                "type": "string",
+                                "metadata": {
+                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
+                                }
+                              },
+                              "enabled": {
+                                "type": "bool",
+                                "nullable": true,
+                                "metadata": {
+                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
+                                }
+                              }
+                            }
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
+                          }
+                        },
+                        "logAnalyticsDestinationType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "AzureDiagnostics",
+                            "Dedicated"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
+                          }
+                        },
+                        "workspaceResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "storageAccountResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "eventHubAuthorizationRuleResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
+                          }
+                        },
+                        "eventHubName": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
+                          }
+                        },
+                        "marketplacePartnerResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "lockType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the name of lock."
+                          }
+                        },
+                        "kind": {
+                          "type": "string",
+                          "allowedValues": [
+                            "CanNotDelete",
+                            "None",
+                            "ReadOnly"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the type of lock."
+                          }
+                        },
+                        "notes": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Specify the notes of the lock."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a lock.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
+                        }
+                      }
+                    },
+                    "managedIdentityAllType": {
+                      "type": "object",
+                      "properties": {
+                        "systemAssigned": {
+                          "type": "bool",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Enables system assigned managed identity on the resource."
+                          }
+                        },
+                        "userAssignedResourceIds": {
+                          "type": "array",
+                          "items": {
+                            "type": "string"
+                          },
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                        }
+                      }
+                    },
+                    "roleAssignmentType": {
+                      "type": "object",
+                      "properties": {
+                        "name": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
+                          }
+                        },
+                        "roleDefinitionIdOrName": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
+                          }
+                        },
+                        "principalId": {
+                          "type": "string",
+                          "metadata": {
+                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
+                          }
+                        },
+                        "principalType": {
+                          "type": "string",
+                          "allowedValues": [
+                            "Device",
+                            "ForeignGroup",
+                            "Group",
+                            "ServicePrincipal",
+                            "User"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The principal type of the assigned principal ID."
+                          }
+                        },
+                        "description": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The description of the role assignment."
+                          }
+                        },
+                        "condition": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
+                          }
+                        },
+                        "conditionVersion": {
+                          "type": "string",
+                          "allowedValues": [
+                            "2.0"
+                          ],
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. Version of the condition."
+                          }
+                        },
+                        "delegatedManagedIdentityResourceId": {
+                          "type": "string",
+                          "nullable": true,
+                          "metadata": {
+                            "description": "Optional. The Resource Id of the delegated managed identity resource."
+                          }
+                        }
+                      },
+                      "metadata": {
+                        "description": "An AVM-aligned type for a role assignment.",
+                        "__bicep_imported_from!": {
+                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
+                        }
+                      }
+                    }
+                  },
+                  "parameters": {
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Name of the Container App."
+                      }
+                    },
+                    "location": {
+                      "type": "string",
+                      "defaultValue": "[resourceGroup().location]",
+                      "metadata": {
+                        "description": "Optional. Location for all Resources."
+                      }
+                    },
+                    "kind": {
+                      "type": "string",
+                      "defaultValue": "containerapps",
+                      "allowedValues": [
+                        "containerapps",
+                        "workflowapp",
+                        "functionapp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Metadata used to render different experiences for resources of the same type."
+                      }
+                    },
+                    "disableIngress": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Bool to disable all ingress traffic for the container app."
+                      }
+                    },
+                    "ingressExternal": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
+                      }
+                    },
+                    "clientCertificateMode": {
+                      "type": "string",
+                      "defaultValue": "ignore",
+                      "allowedValues": [
+                        "accept",
+                        "ignore",
+                        "require"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Client certificate mode for mTLS."
+                      }
+                    },
+                    "corsPolicy": {
+                      "$ref": "#/definitions/corsPolicyType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Object userd to configure CORS policy."
+                      }
+                    },
+                    "stickySessionsAffinity": {
+                      "type": "string",
+                      "defaultValue": "none",
+                      "allowedValues": [
+                        "none",
+                        "sticky"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
+                      }
+                    },
+                    "ingressTransport": {
+                      "type": "string",
+                      "defaultValue": "auto",
+                      "allowedValues": [
+                        "auto",
+                        "http",
+                        "http2",
+                        "tcp"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Ingress transport protocol."
+                      }
+                    },
+                    "service": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/service"
+                        },
+                        "description": "Optional. Dev ContainerApp service type."
+                      },
+                      "nullable": true
+                    },
+                    "includeAddOns": {
+                      "type": "bool",
+                      "defaultValue": false,
+                      "metadata": {
+                        "description": "Optional. Toggle to include the service configuration."
+                      }
+                    },
+                    "additionalPortMappings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/ingressPortMappingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Settings to expose additional ports on container app."
+                      }
+                    },
+                    "ingressAllowInsecure": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
+                      }
+                    },
+                    "ingressTargetPort": {
+                      "type": "int",
+                      "defaultValue": 80,
+                      "metadata": {
+                        "description": "Optional. Target Port in containers for traffic from ingress."
+                      }
+                    },
+                    "scaleSettings": {
+                      "$ref": "#/definitions/scaleType",
+                      "defaultValue": {
+                        "maxReplicas": 10,
+                        "minReplicas": 3
+                      },
+                      "metadata": {
+                        "description": "Optional. The scaling settings of the service."
+                      }
+                    },
+                    "serviceBinds": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/serviceBindingType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. List of container app services bound to the app."
+                      }
+                    },
+                    "activeRevisionsMode": {
+                      "type": "string",
+                      "defaultValue": "Single",
+                      "allowedValues": [
+                        "Multiple",
+                        "Single"
+                      ],
+                      "metadata": {
+                        "description": "Optional. Controls how active revisions are handled for the Container app."
+                      }
+                    },
+                    "environmentResourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "Required. Resource ID of environment."
+                      }
+                    },
+                    "lock": {
+                      "$ref": "#/definitions/lockType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The lock settings of the service."
+                      }
+                    },
+                    "tags": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/tags"
+                        },
+                        "description": "Optional. Tags of the resource."
+                      },
+                      "nullable": true
+                    },
+                    "registries": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/registries"
+                        },
+                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
+                      },
+                      "nullable": true
+                    },
+                    "managedIdentities": {
+                      "$ref": "#/definitions/managedIdentityAllType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The managed identity definition for this resource."
+                      }
+                    },
+                    "roleAssignments": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/roleAssignmentType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Array of role assignments to create."
+                      }
+                    },
+                    "enableTelemetry": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Enable/Disable usage telemetry for module."
+                      }
+                    },
+                    "customDomains": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/customDomains"
+                        },
+                        "description": "Optional. Custom domain bindings for Container App hostnames."
+                      },
+                      "nullable": true
+                    },
+                    "exposedPort": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
+                      }
+                    },
+                    "ipSecurityRestrictions": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/ipSecurityRestrictions"
+                        },
+                        "description": "Optional. Rules to restrict incoming IP address."
+                      },
+                      "nullable": true
+                    },
+                    "trafficLabel": {
+                      "type": "string",
+                      "defaultValue": "label-1",
+                      "metadata": {
+                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
+                      }
+                    },
+                    "trafficLatestRevision": {
+                      "type": "bool",
+                      "defaultValue": true,
+                      "metadata": {
+                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
+                      }
+                    },
+                    "trafficRevisionName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Name of a revision."
+                      }
+                    },
+                    "trafficWeight": {
+                      "type": "int",
+                      "defaultValue": 100,
+                      "metadata": {
+                        "description": "Optional. Traffic weight assigned to a revision."
+                      }
+                    },
+                    "dapr": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/dapr"
+                        },
+                        "description": "Optional. Dapr configuration for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "identitySettings": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/identitySettings"
+                        },
+                        "description": "Optional. Settings for Managed Identities that are assigned to the Container App. If a Managed Identity is not specified here, default settings will be used."
+                      },
+                      "nullable": true
+                    },
+                    "maxInactiveRevisions": {
+                      "type": "int",
+                      "defaultValue": 0,
+                      "metadata": {
+                        "description": "Optional. Max inactive revisions a Container App can have."
+                      }
+                    },
+                    "runtime": {
+                      "type": "object",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/runtime"
+                        },
+                        "description": "Optional. Runtime configuration for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "containers": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/containers"
+                        },
+                        "description": "Required. List of container definitions for the Container App."
+                      }
+                    },
+                    "terminationGracePeriodSeconds": {
+                      "type": "int",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The termination grace period for the container app."
+                      }
+                    },
+                    "initContainersTemplate": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/initContainers"
+                        },
+                        "description": "Optional. List of specialized containers that run before app containers."
+                      },
+                      "nullable": true
+                    },
+                    "secrets": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/secretType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The secrets of the Container App."
+                      }
+                    },
+                    "revisionSuffix": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. User friendly suffix that is appended to the revision name."
+                      }
+                    },
+                    "volumes": {
+                      "type": "array",
+                      "metadata": {
+                        "__bicep_resource_derived_type!": {
+                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/volumes"
+                        },
+                        "description": "Optional. List of volume definitions for the Container App."
+                      },
+                      "nullable": true
+                    },
+                    "workloadProfileName": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. Workload profile name to pin for container app execution."
+                      }
+                    },
+                    "authConfig": {
+                      "$ref": "#/definitions/authConfigType",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The name of the Container App Auth configs."
+                      }
+                    },
+                    "diagnosticSettings": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
+                      },
+                      "nullable": true,
+                      "metadata": {
+                        "description": "Optional. The diagnostic settings of the service."
+                      }
+                    }
+                  },
+                  "variables": {
+                    "copy": [
+                      {
+                        "name": "formattedRoleAssignments",
+                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
+                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
+                      }
+                    ],
+                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
+                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
+                    "builtInRoleNames": {
+                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
+                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
+                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
+                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
+                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
+                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
+                    }
+                  },
+                  "resources": {
+                    "avmTelemetry": {
+                      "condition": "[parameters('enableTelemetry')]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2024-03-01",
+                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
+                      "properties": {
+                        "mode": "Incremental",
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "contentVersion": "1.0.0.0",
+                          "resources": [],
+                          "outputs": {
+                            "telemetry": {
+                              "type": "String",
+                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
+                            }
+                          }
+                        }
+                      }
+                    },
+                    "containerApp": {
+                      "type": "Microsoft.App/containerApps",
+                      "apiVersion": "2025-02-02-preview",
+                      "name": "[parameters('name')]",
+                      "tags": "[parameters('tags')]",
+                      "kind": "[parameters('kind')]",
+                      "location": "[parameters('location')]",
+                      "identity": "[variables('identity')]",
+                      "properties": {
+                        "environmentId": "[parameters('environmentResourceId')]",
+                        "workloadProfileName": "[parameters('workloadProfileName')]",
+                        "template": {
+                          "containers": "[parameters('containers')]",
+                          "terminationGracePeriodSeconds": "[parameters('terminationGracePeriodSeconds')]",
+                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
+                          "revisionSuffix": "[parameters('revisionSuffix')]",
+                          "scale": "[parameters('scaleSettings')]",
+                          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
+                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
+                        },
+                        "configuration": {
+                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
+                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
+                          "identitySettings": "[if(not(empty(parameters('identitySettings'))), parameters('identitySettings'), null())]",
+                          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
+                          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
+                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
+                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
+                          "secrets": "[parameters('secrets')]",
+                          "runtime": "[if(not(empty(parameters('runtime'))), parameters('runtime'), null())]"
+                        }
+                      }
+                    },
+                    "containerApp_lock": {
+                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
+                      "type": "Microsoft.Authorization/locks",
+                      "apiVersion": "2020-05-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
+                      "properties": {
+                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
+                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_roleAssignments": {
+                      "copy": {
+                        "name": "containerApp_roleAssignments",
+                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
+                      },
+                      "type": "Microsoft.Authorization/roleAssignments",
+                      "apiVersion": "2022-04-01",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
+                      "properties": {
+                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
+                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
+                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
+                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
+                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
+                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
+                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerApp_diagnosticSettings": {
+                      "copy": {
+                        "name": "containerApp_diagnosticSettings",
+                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
+                      },
+                      "type": "Microsoft.Insights/diagnosticSettings",
+                      "apiVersion": "2021-05-01-preview",
+                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
+                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
+                      "properties": {
+                        "copy": [
+                          {
+                            "name": "metrics",
+                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
+                            "input": {
+                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
+                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
+                              "timeGrain": null
+                            }
+                          }
+                        ],
+                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
+                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
+                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
+                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
+                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
+                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    },
+                    "containerAppAuthConfigs": {
+                      "condition": "[not(empty(parameters('authConfig')))]",
+                      "type": "Microsoft.Resources/deployments",
+                      "apiVersion": "2025-04-01",
+                      "name": "[format('{0}-auth-config', uniqueString(deployment().name, parameters('location')))]",
+                      "properties": {
+                        "expressionEvaluationOptions": {
+                          "scope": "inner"
+                        },
+                        "mode": "Incremental",
+                        "parameters": {
+                          "containerAppName": {
+                            "value": "[parameters('name')]"
+                          },
+                          "encryptionSettings": {
+                            "value": "[tryGet(parameters('authConfig'), 'encryptionSettings')]"
+                          },
+                          "globalValidation": {
+                            "value": "[tryGet(parameters('authConfig'), 'globalValidation')]"
+                          },
+                          "httpSettings": {
+                            "value": "[tryGet(parameters('authConfig'), 'httpSettings')]"
+                          },
+                          "identityProviders": {
+                            "value": "[tryGet(parameters('authConfig'), 'identityProviders')]"
+                          },
+                          "login": {
+                            "value": "[tryGet(parameters('authConfig'), 'login')]"
+                          },
+                          "platform": {
+                            "value": "[tryGet(parameters('authConfig'), 'platform')]"
+                          }
+                        },
+                        "template": {
+                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+                          "languageVersion": "2.0",
+                          "contentVersion": "1.0.0.0",
+                          "metadata": {
+                            "_generator": {
+                              "name": "bicep",
+                              "version": "0.38.33.27573",
+                              "templateHash": "12480411243596309951"
+                            },
+                            "name": "Container App Auth Configs",
+                            "description": "This module deploys Container App Auth Configs."
+                          },
+                          "parameters": {
+                            "containerAppName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "Conditional. The name of the parent Container App. Required if the template is used in a standalone deployment."
+                              }
+                            },
+                            "encryptionSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
+                                },
+                                "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "globalValidation": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
+                                },
+                                "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "httpSettings": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
+                                },
+                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "identityProviders": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
+                                },
+                                "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "login": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
+                                },
+                                "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            },
+                            "platform": {
+                              "type": "object",
+                              "metadata": {
+                                "__bicep_resource_derived_type!": {
+                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
+                                },
+                                "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
+                              },
+                              "nullable": true
+                            }
+                          },
+                          "resources": {
+                            "containerApp": {
+                              "existing": true,
+                              "type": "Microsoft.App/containerApps",
+                              "apiVersion": "2025-02-02-preview",
+                              "name": "[parameters('containerAppName')]"
+                            },
+                            "containerAppAuthConfigs": {
+                              "type": "Microsoft.App/containerApps/authConfigs",
+                              "apiVersion": "2025-02-02-preview",
+                              "name": "[format('{0}/{1}', parameters('containerAppName'), 'current')]",
+                              "properties": {
+                                "encryptionSettings": "[parameters('encryptionSettings')]",
+                                "globalValidation": "[parameters('globalValidation')]",
+                                "httpSettings": "[parameters('httpSettings')]",
+                                "identityProviders": "[parameters('identityProviders')]",
+                                "login": "[parameters('login')]",
+                                "platform": "[parameters('platform')]"
+                              }
+                            }
+                          },
+                          "outputs": {
+                            "name": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The name of the set of Container App Auth configs."
+                              },
+                              "value": "current"
+                            },
+                            "resourceId": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource ID of the set of Container App Auth configs."
+                              },
+                              "value": "[resourceId('Microsoft.App/containerApps/authConfigs', parameters('containerAppName'), 'current')]"
+                            },
+                            "resourceGroupName": {
+                              "type": "string",
+                              "metadata": {
+                                "description": "The resource group containing the set of Container App Auth configs."
+                              },
+                              "value": "[resourceGroup().name]"
+                            }
+                          }
+                        }
+                      },
+                      "dependsOn": [
+                        "containerApp"
+                      ]
+                    }
+                  },
+                  "outputs": {
+                    "resourceId": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The resource ID of the Container App."
+                      },
+                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
+                    },
+                    "fqdn": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The configuration of ingress fqdn."
+                      },
+                      "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
+                    },
+                    "resourceGroupName": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the resource group the Container App was deployed into."
+                      },
+                      "value": "[resourceGroup().name]"
+                    },
+                    "name": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The name of the Container App."
+                      },
+                      "value": "[parameters('name')]"
+                    },
+                    "systemAssignedMIPrincipalId": {
+                      "type": "string",
+                      "nullable": true,
+                      "metadata": {
+                        "description": "The principal ID of the system assigned identity."
+                      },
+                      "value": "[tryGet(tryGet(reference('containerApp', '2025-02-02-preview', 'full'), 'identity'), 'principalId')]"
+                    },
+                    "location": {
+                      "type": "string",
+                      "metadata": {
+                        "description": "The location the resource was deployed into."
+                      },
+                      "value": "[reference('containerApp', '2025-02-02-preview', 'full').location]"
+                    }
+                  }
+                }
+              }
+            }
+          ],
+          "outputs": {
+            "resourceId": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.resourceId.value]"
+            },
+            "name": {
+              "type": "string",
+              "value": "[format('{0}.containerApp', deployment().name)]"
+            },
+            "fqdn": {
+              "type": "string",
+              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.fqdn.value]"
+            }
+          }
+        }
+      },
+      "dependsOn": [
+        "apiContainerApp",
+        "containerAppsEnvironment",
+        "containerRegistry",
+        "userAssignedIdentity"
+      ]
+    }
+  },
+  "outputs": {
+    "DEPLOYMENT_MODE": {
+      "type": "string",
+      "value": "[parameters('deploymentMode')]"
+    },
+    "AZURE_LOCATION": {
+      "type": "string",
+      "value": "[parameters('location')]"
+    },
+    "AZURE_TENANT_ID": {
+      "type": "string",
+      "value": "[tenant().tenantId]"
+    },
+    "AZURE_RESOURCE_GROUP": {
+      "type": "string",
+      "value": "[resourceGroup().name]"
+    },
+    "AZURE_CONTAINER_REGISTRY_ENDPOINT": {
+      "type": "string",
+      "value": "[reference('containerRegistry').outputs.loginServer.value]"
+    },
+    "AZURE_CONTAINER_REGISTRY_NAME": {
+      "type": "string",
+      "value": "[reference('containerRegistry').outputs.name.value]"
+    },
+    "API_ENDPOINT": {
+      "type": "string",
+      "value": "[format('https://{0}', reference('apiContainerApp').outputs.fqdn.value)]"
+    },
+    "WORKER_ENDPOINT": {
+      "type": "string",
+      "value": "[format('https://{0}', reference('workerContainerApp').outputs.fqdn.value)]"
+    },
+    "WEB_ENDPOINT": {
+      "type": "string",
+      "value": "[format('https://{0}', reference('webContainerApp').outputs.fqdn.value)]"
+    },
+    "COSMOS_DB_ENDPOINT": {
+      "type": "string",
+      "value": "[reference('cosmos').outputs.cosmosEndpoint.value]"
+    },
+    "COSMOS_DB_NAME": {
+      "type": "string",
+      "value": "[parameters('cosmosDbName')]"
+    },
+    "STORAGE_ACCOUNT_NAME": {
+      "type": "string",
+      "value": "[reference('storage').outputs.name.value]"
+    },
+    "STORAGE_QUEUE_URL": {
+      "type": "string",
+      "value": "[reference('storage').outputs.primaryQueueEndpoint.value]"
+    },
+    "STORAGE_QUEUE_NAME": {
+      "type": "string",
+      "value": "[parameters('workerQueueName')]"
+    },
+    "APP_CONFIG_ENDPOINT": {
+      "type": "string",
+      "value": "[reference('appConfigStore').outputs.endpoint.value]"
+    },
+    "APPLICATIONINSIGHTS_CONNECTION_STRING": {
+      "type": "string",
+      "value": "[if(not(empty(parameters('existingAppInsightsId'))), reference(parameters('existingAppInsightsId'), '2020-02-02').ConnectionString, if(variables('shouldCreateAppInsights'), reference('appInsights').outputs.connectionString.value, ''))]"
+    },
+    "MANAGED_IDENTITY_CLIENT_ID": {
+      "type": "string",
+      "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
+    },
+    "MANAGED_IDENTITY_PRINCIPAL_ID": {
+      "type": "string",
+      "value": "[reference('userAssignedIdentity').outputs.principalId.value]"
+    },
+    "AZURE_AI_FOUNDRY_LOCATION": {
+      "type": "string",
+      "value": "[reference('aiFoundry').outputs.location.value]"
+    },
+    "AI_PROJECT_NAME": {
+      "type": "string",
+      "value": "[reference('aiFoundry').outputs.aiProjectName.value]"
+    },
+    "AI_SERVICES_NAME": {
+      "type": "string",
+      "value": "[reference('aiFoundry').outputs.aiServicesName.value]"
+    },
+    "VNET_RESOURCE_ID": {
+      "type": "string",
+      "value": "[if(variables('isAILZIntegrated'), parameters('existingVnetResourceId'), '')]"
+    },
+    "PRIVATE_ENDPOINT_SUBNET_ID": {
+      "type": "string",
+      "value": "[if(variables('isAILZIntegrated'), variables('networkConfig').privateEndpointSubnetId, '')]"
+    },
+    "CONTAINER_APPS_SUBNET_ID": {
+      "type": "string",
+      "value": "[if(variables('isAILZIntegrated'), variables('networkConfig').containerAppsSubnetId, '')]"
+    }
+  }
+}
\ No newline at end of file
diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index fabbc7f..d9b6a97 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -25,14 +25,35 @@ az storage queue create \
   --auth-mode login \
   --only-show-errors || echo "Queue already exists or error creating queue"
 
+# ========== DEPLOYER ROLE ASSIGNMENT ==========
+echo ""
+echo "=================================================="
+echo "Deployer Role - Cognitive Services Contributor"
+echo "=================================================="
+
+AI_SERVICES_NAME=$(azd env get-value AI_SERVICES_NAME 2>/dev/null || echo "")
+DEPLOYER_OID=$(az ad signed-in-user show --query id -o tsv 2>/dev/null || echo "")
+
+if [ -n "$DEPLOYER_OID" ] && [ -n "$AI_SERVICES_NAME" ]; then
+    echo "Ensuring deployer ($DEPLOYER_OID) has Cognitive Services Contributor on $AI_SERVICES_NAME..."
+    az role assignment create \
+        --assignee "$DEPLOYER_OID" \
+        --role "Cognitive Services Contributor" \
+        --scope "/subscriptions/$(az account show --query id -o tsv)/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.CognitiveServices/accounts/${AI_SERVICES_NAME}" \
+        --only-show-errors 2>/dev/null \
+        && echo "  ✅ Deployer has Cognitive Services Contributor" \
+        || echo "  ⚠️  Could not assign role (may need Owner/UAA permissions on the scope)"
+else
+    echo "⚠️  Could not determine deployer identity or AI Services name. Skipping role assignment."
+fi
+
 # ========== CONTENT UNDERSTANDING SETUP ==========
 echo ""
 echo "=================================================="
 echo "Content Understanding - Model Defaults & Analyzers"
 echo "=================================================="
 
-# Resolve AI Services endpoint from Bicep output
-AI_SERVICES_NAME=$(azd env get-value AI_SERVICES_NAME 2>/dev/null || echo "")
+# AI_SERVICES_NAME already resolved above
 
 if [ -z "$AI_SERVICES_NAME" ]; then
     echo "⚠️  AI_SERVICES_NAME not found in azd env. Skipping CU setup."

From 5d15a41b588daf4ada7eb3d6902c52f07f0098f5 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Tue, 26 May 2026 18:49:09 +0000
Subject: [PATCH 17/28] fix: assign Azure AI Developer role in post-provision
 for CU write access

- Replace Azure AI User (read-only) with Azure AI Developer (read+write) so
  PATCH /defaults and PUT /analyzers succeed without HTTP 401
- Remove user role assignment from ai-foundry.bicep to avoid RoleAssignmentExists
  conflict when role was previously assigned via CLI with a different GUID
- Switch from --assignee to --assignee-object-id to avoid Microsoft Graph lookup
- Add idempotent RoleAssignmentExists detection for clean re-run output
- Add sleep 90 for RBAC propagation before CU API calls
- Reduce text-embedding-3-large capacity to 40 (quota)
---
 infra/bicep/modules/ai-foundry.bicep | 22 ++++++++-------
 infra/scripts/post-provision.sh      | 42 +++++++++++++++++++++++-----
 2 files changed, 47 insertions(+), 17 deletions(-)

diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep
index 0ef292a..ef7c815 100644
--- a/infra/bicep/modules/ai-foundry.bicep
+++ b/infra/bicep/modules/ai-foundry.bicep
@@ -10,8 +10,16 @@ param roleAssignedManagedIdentityPrincipalIds string[] = []
 @description('Tags for resources')
 param tags object = {}
 
-// Ensure unique role assignments
-var uniqueRoleAssignmentManagedIdentities = union(roleAssignedManagedIdentityPrincipalIds, roleAssignedManagedIdentityPrincipalIds)
+// NOTE: User/human deployer role assignments (Azure AI Developer) are intentionally NOT done here.
+// ARM role assignments have deterministic GUIDs computed from scope+principal+role. If the same role
+// was previously assigned via CLI (random GUID), Bicep will conflict with a RoleAssignmentExists error
+// and fail the entire deployment. post-provision.sh owns all user role assignments exclusively,
+// using `az role assignment create` which is idempotent and handles duplicates gracefully.
+var managedIdentityRoleAssignments = [for principalId in roleAssignedManagedIdentityPrincipalIds: {
+  principalId: principalId
+  principalType: 'ServicePrincipal'
+  roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // 'Azure AI User'
+}]
 
 module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
   params: {
@@ -31,13 +39,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         displayName: 'ContentFlow'
         name: 'contentflow-project'
       }
-      roleAssignments: [
-          for principalId in uniqueRoleAssignmentManagedIdentities: {
-            principalId: principalId
-            principalType: 'ServicePrincipal'
-            roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // 'Azure AI User'
-          }
-        ]
+      roleAssignments: managedIdentityRoleAssignments
       sku: 'S0'
     }
     aiModelDeployments: [
@@ -73,7 +75,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         }
         name: 'text-embedding-3-large'
         sku: {
-          capacity: 70
+          capacity: 40
           name: 'Standard'
         }
       }
diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index d3401ab..9860cb2 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -30,21 +30,43 @@ echo "Cosmos DB Endpoint: $COSMOS_ENDPOINT"
 # ========== DEPLOYER ROLE ASSIGNMENT ==========
 echo ""
 echo "=================================================="
-echo "Deployer Role - Cognitive Services Contributor"
+echo "Deployer Role - Cognitive Services Contributor & Azure AI Developer"
 echo "=================================================="
 
 AI_SERVICES_NAME=$(azd env get-value AI_SERVICES_NAME 2>/dev/null || echo "")
 DEPLOYER_OID=$(az ad signed-in-user show --query id -o tsv 2>/dev/null || echo "")
 
 if [ -n "$DEPLOYER_OID" ] && [ -n "$AI_SERVICES_NAME" ]; then
+    AI_SERVICES_SCOPE="/subscriptions/$(az account show --query id -o tsv)/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.CognitiveServices/accounts/${AI_SERVICES_NAME}"
+
     echo "Ensuring deployer ($DEPLOYER_OID) has Cognitive Services Contributor on $AI_SERVICES_NAME..."
-    az role assignment create \
-        --assignee "$DEPLOYER_OID" \
+    ROLE_OUT=$(az role assignment create \
+        --assignee-object-id "$DEPLOYER_OID" \
+        --assignee-principal-type User \
         --role "Cognitive Services Contributor" \
-        --scope "/subscriptions/$(az account show --query id -o tsv)/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.CognitiveServices/accounts/${AI_SERVICES_NAME}" \
-        --only-show-errors 2>/dev/null \
-        && echo "  ✅ Deployer has Cognitive Services Contributor" \
-        || echo "  ⚠️  Could not assign role (may need Owner/UAA permissions on the scope)"
+        --scope "$AI_SERVICES_SCOPE" \
+        --only-show-errors 2>&1) && \
+        echo "  ✅ Deployer has Cognitive Services Contributor" || \
+        { echo "$ROLE_OUT" | grep -qi "RoleAssignmentExists" && \
+            echo "  ✅ Deployer already has Cognitive Services Contributor" || \
+            echo "  ⚠️  Could not assign Cognitive Services Contributor (may need Owner/UAA permissions on the scope)"; }
+
+    # Azure AI Developer is the DATA-PLANE write role required for:
+    #   - Setting CU defaults (PATCH /contentunderstanding/defaults)
+    #   - Creating/updating analyzers (PUT /contentunderstanding/analyzers/{id})
+    #   - Accessing CU Studio (superset of Azure AI User — covers read access too)
+    # Azure AI User (read-only) is NOT sufficient; it causes 401 on any write operation.
+    echo "Ensuring deployer ($DEPLOYER_OID) has Azure AI Developer on $AI_SERVICES_NAME..."
+    ROLE_OUT=$(az role assignment create \
+        --assignee-object-id "$DEPLOYER_OID" \
+        --assignee-principal-type User \
+        --role "Azure AI Developer" \
+        --scope "$AI_SERVICES_SCOPE" \
+        --only-show-errors 2>&1) && \
+        echo "  ✅ Deployer has Azure AI Developer (data-plane read+write — required for CU setup & Studio)" || \
+        { echo "$ROLE_OUT" | grep -qi "RoleAssignmentExists" && \
+            echo "  ✅ Deployer already has Azure AI Developer" || \
+            echo "  ⚠️  Could not assign Azure AI Developer (may need Owner/UAA permissions on the scope)"; }
 else
     echo "⚠️  Could not determine deployer identity or AI Services name. Skipping role assignment."
 fi
@@ -66,6 +88,12 @@ else
     CU_API_VERSION="2025-11-01"
     echo "CU Endpoint: $CU_ENDPOINT"
 
+    # Wait for RBAC role assignments to propagate before calling data-plane APIs.
+    # Azure RBAC propagation typically takes 1–5 minutes; without this wait the CU
+    # API calls immediately after role assignment will fail with HTTP 403.
+    echo "Waiting 90 seconds for RBAC role assignments to propagate..."
+    sleep 90
+
     # Obtain a bearer token for Cognitive Services scope
     echo "Acquiring access token..."
     ACCESS_TOKEN=$(az account get-access-token \

From 60fdb1d862f029e4e325192c0960a182cb1ab716 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Tue, 26 May 2026 18:49:09 +0000
Subject: [PATCH 18/28] fix: assign Azure AI Developer role in post-provision
 for CU write access

- Replace Azure AI User (read-only) with Azure AI Developer (read+write) so
  PATCH /defaults and PUT /analyzers succeed without HTTP 401
- Remove user role assignment from ai-foundry.bicep to avoid RoleAssignmentExists
  conflict when role was previously assigned via CLI with a different GUID
- Switch from --assignee to --assignee-object-id to avoid Microsoft Graph lookup
- Add idempotent RoleAssignmentExists detection for clean re-run output
- Add sleep 90 for RBAC propagation before CU API calls
- Reduce text-embedding-3-large capacity to 40 (quota)
---
 infra/bicep/modules/ai-foundry.bicep | 22 ++++++++-------
 infra/scripts/post-provision.sh      | 42 +++++++++++++++++++++++-----
 2 files changed, 47 insertions(+), 17 deletions(-)

diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep
index 8fdb66c..ef7c815 100644
--- a/infra/bicep/modules/ai-foundry.bicep
+++ b/infra/bicep/modules/ai-foundry.bicep
@@ -10,8 +10,16 @@ param roleAssignedManagedIdentityPrincipalIds string[] = []
 @description('Tags for resources')
 param tags object = {}
 
-// Ensure unique role assignments
-var uniqueRoleAssignmentManagedIdentities = union(roleAssignedManagedIdentityPrincipalIds, roleAssignedManagedIdentityPrincipalIds)
+// NOTE: User/human deployer role assignments (Azure AI Developer) are intentionally NOT done here.
+// ARM role assignments have deterministic GUIDs computed from scope+principal+role. If the same role
+// was previously assigned via CLI (random GUID), Bicep will conflict with a RoleAssignmentExists error
+// and fail the entire deployment. post-provision.sh owns all user role assignments exclusively,
+// using `az role assignment create` which is idempotent and handles duplicates gracefully.
+var managedIdentityRoleAssignments = [for principalId in roleAssignedManagedIdentityPrincipalIds: {
+  principalId: principalId
+  principalType: 'ServicePrincipal'
+  roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // 'Azure AI User'
+}]
 
 module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
   params: {
@@ -31,13 +39,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         displayName: 'ContentFlow'
         name: 'contentflow-project'
       }
-      roleAssignments: [
-          for principalId in uniqueRoleAssignmentManagedIdentities: {
-            principalId: principalId
-            principalType: 'ServicePrincipal'
-            roleDefinitionIdOrName: '53ca6127-db72-4b80-b1b0-d745d6d5456d' // 'Azure AI User'
-          }
-        ]
+      roleAssignments: managedIdentityRoleAssignments
       sku: 'S0'
     }
     aiModelDeployments: [
@@ -73,7 +75,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         }
         name: 'text-embedding-3-large'
         sku: {
-          capacity: 100
+          capacity: 40
           name: 'Standard'
         }
       }
diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index d9b6a97..a06ce71 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -28,21 +28,43 @@ az storage queue create \
 # ========== DEPLOYER ROLE ASSIGNMENT ==========
 echo ""
 echo "=================================================="
-echo "Deployer Role - Cognitive Services Contributor"
+echo "Deployer Role - Cognitive Services Contributor & Azure AI Developer"
 echo "=================================================="
 
 AI_SERVICES_NAME=$(azd env get-value AI_SERVICES_NAME 2>/dev/null || echo "")
 DEPLOYER_OID=$(az ad signed-in-user show --query id -o tsv 2>/dev/null || echo "")
 
 if [ -n "$DEPLOYER_OID" ] && [ -n "$AI_SERVICES_NAME" ]; then
+    AI_SERVICES_SCOPE="/subscriptions/$(az account show --query id -o tsv)/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.CognitiveServices/accounts/${AI_SERVICES_NAME}"
+
     echo "Ensuring deployer ($DEPLOYER_OID) has Cognitive Services Contributor on $AI_SERVICES_NAME..."
-    az role assignment create \
-        --assignee "$DEPLOYER_OID" \
+    ROLE_OUT=$(az role assignment create \
+        --assignee-object-id "$DEPLOYER_OID" \
+        --assignee-principal-type User \
         --role "Cognitive Services Contributor" \
-        --scope "/subscriptions/$(az account show --query id -o tsv)/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.CognitiveServices/accounts/${AI_SERVICES_NAME}" \
-        --only-show-errors 2>/dev/null \
-        && echo "  ✅ Deployer has Cognitive Services Contributor" \
-        || echo "  ⚠️  Could not assign role (may need Owner/UAA permissions on the scope)"
+        --scope "$AI_SERVICES_SCOPE" \
+        --only-show-errors 2>&1) && \
+        echo "  ✅ Deployer has Cognitive Services Contributor" || \
+        { echo "$ROLE_OUT" | grep -qi "RoleAssignmentExists" && \
+            echo "  ✅ Deployer already has Cognitive Services Contributor" || \
+            echo "  ⚠️  Could not assign Cognitive Services Contributor (may need Owner/UAA permissions on the scope)"; }
+
+    # Azure AI Developer is the DATA-PLANE write role required for:
+    #   - Setting CU defaults (PATCH /contentunderstanding/defaults)
+    #   - Creating/updating analyzers (PUT /contentunderstanding/analyzers/{id})
+    #   - Accessing CU Studio (superset of Azure AI User — covers read access too)
+    # Azure AI User (read-only) is NOT sufficient; it causes 401 on any write operation.
+    echo "Ensuring deployer ($DEPLOYER_OID) has Azure AI Developer on $AI_SERVICES_NAME..."
+    ROLE_OUT=$(az role assignment create \
+        --assignee-object-id "$DEPLOYER_OID" \
+        --assignee-principal-type User \
+        --role "Azure AI Developer" \
+        --scope "$AI_SERVICES_SCOPE" \
+        --only-show-errors 2>&1) && \
+        echo "  ✅ Deployer has Azure AI Developer (data-plane read+write — required for CU setup & Studio)" || \
+        { echo "$ROLE_OUT" | grep -qi "RoleAssignmentExists" && \
+            echo "  ✅ Deployer already has Azure AI Developer" || \
+            echo "  ⚠️  Could not assign Azure AI Developer (may need Owner/UAA permissions on the scope)"; }
 else
     echo "⚠️  Could not determine deployer identity or AI Services name. Skipping role assignment."
 fi
@@ -64,6 +86,12 @@ else
     CU_API_VERSION="2025-11-01"
     echo "CU Endpoint: $CU_ENDPOINT"
 
+    # Wait for RBAC role assignments to propagate before calling data-plane APIs.
+    # Azure RBAC propagation typically takes 1–5 minutes; without this wait the CU
+    # API calls immediately after role assignment will fail with HTTP 403.
+    echo "Waiting 90 seconds for RBAC role assignments to propagate..."
+    sleep 90
+
     # Obtain a bearer token for Cognitive Services scope
     echo "Acquiring access token..."
     ACCESS_TOKEN=$(az account get-access-token \

From 010a0b48efda6d91e3a8e182c6ec21a92ea7f843 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Tue, 26 May 2026 18:53:52 +0000
Subject: [PATCH 19/28] updated the textembedding3large capacity to default 100
 value

---
 infra/bicep/modules/ai-foundry.bicep | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep
index ef7c815..049e1c8 100644
--- a/infra/bicep/modules/ai-foundry.bicep
+++ b/infra/bicep/modules/ai-foundry.bicep
@@ -75,7 +75,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         }
         name: 'text-embedding-3-large'
         sku: {
-          capacity: 40
+          capacity: 100
           name: 'Standard'
         }
       }

From 2a2251ebc8d8d0eb4f6a9e7eee92bfe5b25aed47 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Wed, 27 May 2026 16:57:16 +0000
Subject: [PATCH 20/28] feat: replace fixed RBAC sleep with readiness probe and
 add retry logic to CU setup

---
 infra/scripts/post-provision.sh | 190 ++++++++++++++++++++++++--------
 1 file changed, 142 insertions(+), 48 deletions(-)

diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index 9860cb2..9f25446 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -88,45 +88,101 @@ else
     CU_API_VERSION="2025-11-01"
     echo "CU Endpoint: $CU_ENDPOINT"
 
-    # Wait for RBAC role assignments to propagate before calling data-plane APIs.
-    # Azure RBAC propagation typically takes 1–5 minutes; without this wait the CU
-    # API calls immediately after role assignment will fail with HTTP 403.
-    echo "Waiting 90 seconds for RBAC role assignments to propagate..."
-    sleep 90
-
-    # Obtain a bearer token for Cognitive Services scope
-    echo "Acquiring access token..."
-    ACCESS_TOKEN=$(az account get-access-token \
-        --resource "https://cognitiveservices.azure.com" \
-        --query accessToken -o tsv 2>/dev/null || echo "")
-
-    if [ -z "$ACCESS_TOKEN" ]; then
-        echo "⚠️  Failed to acquire access token. Skipping CU setup."
-        echo "   Ensure the deployer identity has 'Cognitive Services User' role."
+    # --- Helper: acquire a bearer token for Cognitive Services scope ---
+    acquire_token() {
+        az account get-access-token \
+            --resource "https://cognitiveservices.azure.com" \
+            --query accessToken -o tsv 2>/dev/null || echo ""
+    }
+
+    # --- RBAC Readiness Probe ---
+    # Instead of a fixed sleep, poll the CU data-plane until RBAC propagates.
+    # Retries every 30s for up to 10 minutes (20 attempts).
+    echo "Probing CU data-plane for RBAC readiness (up to 10 minutes)..."
+    RBAC_MAX_ATTEMPTS=20
+    RBAC_WAIT_SECONDS=30
+    RBAC_READY=false
+    ACCESS_TOKEN=""
+
+    for RBAC_ATTEMPT in $(seq 1 $RBAC_MAX_ATTEMPTS); do
+        ACCESS_TOKEN=$(acquire_token)
+        if [ -z "$ACCESS_TOKEN" ]; then
+            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] Failed to acquire token — retrying in ${RBAC_WAIT_SECONDS}s..."
+            sleep "$RBAC_WAIT_SECONDS"
+            continue
+        fi
+
+        PROBE_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            "${CU_ENDPOINT}/contentunderstanding/analyzers?api-version=${CU_API_VERSION}" \
+            -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null)
+
+        if [ "$PROBE_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$PROBE_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+            echo "  ✅ RBAC is active (HTTP $PROBE_HTTP_CODE on attempt $RBAC_ATTEMPT)"
+            RBAC_READY=true
+            break
+        else
+            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] RBAC not ready (HTTP $PROBE_HTTP_CODE) — retrying in ${RBAC_WAIT_SECONDS}s..."
+            sleep "$RBAC_WAIT_SECONDS"
+        fi
+    done
+
+    if [ "$RBAC_READY" != "true" ]; then
+        echo "❌ RBAC did not propagate within $((RBAC_MAX_ATTEMPTS * RBAC_WAIT_SECONDS)) seconds."
+        echo "   Re-run 'azd up' or 'azd hooks run postprovision' after a few minutes."
+        exit 1
     else
-        # --- Step 1: Set default model deployments ---
+        # --- Step 1: Set default model deployments (with retry) ---
         echo ""
         echo "[CU-1] Setting default model deployments..."
-        CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
-            "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
-            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-            -H "Content-Type: application/merge-patch+json" \
-            -d '{
-                "modelDeployments": {
-                    "gpt-4.1": "gpt-4.1",
-                    "gpt-4.1-mini": "gpt-4.1-mini",
-                    "text-embedding-3-large": "text-embedding-3-large"
-                }
-            }' 2>/dev/null)
-
-        CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
-        CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
-
-        if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-            echo "  ✅ Default model deployments configured successfully"
-        else
-            echo "  ⚠️  Failed to set CU defaults (HTTP $CU_DEFAULTS_HTTP_CODE)"
-            echo "     Response: $CU_DEFAULTS_BODY"
+        DEFAULTS_MAX_RETRIES=5
+        DEFAULTS_BACKOFF=15
+        DEFAULTS_OK=false
+
+        for DEFAULTS_ATTEMPT in $(seq 1 $DEFAULTS_MAX_RETRIES); do
+            # Refresh token before each attempt (handles expiry edge case)
+            if [ "$DEFAULTS_ATTEMPT" -gt 1 ]; then
+                ACCESS_TOKEN=$(acquire_token)
+            fi
+
+            CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
+                "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
+                -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                -H "Content-Type: application/merge-patch+json" \
+                -d '{
+                    "modelDeployments": {
+                        "gpt-4.1": "gpt-4.1",
+                        "gpt-4.1-mini": "gpt-4.1-mini",
+                        "text-embedding-3-large": "text-embedding-3-large"
+                    }
+                }' 2>/dev/null)
+
+            CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
+            CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
+
+            if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+                echo "  ✅ Default model deployments configured successfully (attempt $DEFAULTS_ATTEMPT)"
+                DEFAULTS_OK=true
+                break
+            fi
+
+            # Retry on transient errors (401, 403, 429, 5xx)
+            case "$CU_DEFAULTS_HTTP_CODE" in
+                401|403|429|500|502|503|504)
+                    echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_RETRIES] CU defaults failed (HTTP $CU_DEFAULTS_HTTP_CODE) — retrying in ${DEFAULTS_BACKOFF}s..."
+                    sleep "$DEFAULTS_BACKOFF"
+                    DEFAULTS_BACKOFF=$((DEFAULTS_BACKOFF * 2))
+                    [ "$DEFAULTS_BACKOFF" -gt 120 ] && DEFAULTS_BACKOFF=120
+                    ;;
+                *)
+                    echo "  ⚠️  CU defaults failed with non-retryable error (HTTP $CU_DEFAULTS_HTTP_CODE)"
+                    echo "     Response: $CU_DEFAULTS_BODY"
+                    break
+                    ;;
+            esac
+        done
+
+        if [ "$DEFAULTS_OK" != "true" ]; then
+            echo "  ⚠️  Failed to set CU defaults after $DEFAULTS_MAX_RETRIES attempts."
             echo "     Model deployments may not be available yet. Run post-provision again after models are ready."
         fi
 
@@ -154,22 +210,52 @@ else
 
                 echo "  Creating analyzer: $ANALYZER_ID ..."
 
-                # PUT is create-or-replace (idempotent)
-                ANALYZER_RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT \
-                    "${CU_ENDPOINT}/contentunderstanding/analyzers/${ANALYZER_ID}?api-version=${CU_API_VERSION}" \
-                    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-                    -H "Content-Type: application/json" \
-                    -d @"$ANALYZER_FILE" 2>/dev/null)
+                # PUT is create-or-replace (idempotent) — retry with exponential backoff
+                PUT_MAX_RETRIES=5
+                PUT_BACKOFF=15
+                PUT_OK=false
+
+                for PUT_ATTEMPT in $(seq 1 $PUT_MAX_RETRIES); do
+                    # Refresh token before each retry (handles expiry edge case)
+                    if [ "$PUT_ATTEMPT" -gt 1 ]; then
+                        ACCESS_TOKEN=$(acquire_token)
+                    fi
 
-                ANALYZER_HTTP_CODE=$(echo "$ANALYZER_RESPONSE" | tail -1)
-                ANALYZER_BODY=$(echo "$ANALYZER_RESPONSE" | sed '$d')
+                    ANALYZER_RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT \
+                        "${CU_ENDPOINT}/contentunderstanding/analyzers/${ANALYZER_ID}?api-version=${CU_API_VERSION}" \
+                        -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                        -H "Content-Type: application/json" \
+                        -d @"$ANALYZER_FILE" 2>/dev/null)
 
-                if [ "$ANALYZER_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$ANALYZER_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-                    echo "    ✅ $ANALYZER_ID — created/updated (HTTP $ANALYZER_HTTP_CODE)"
+                    ANALYZER_HTTP_CODE=$(echo "$ANALYZER_RESPONSE" | tail -1)
+                    ANALYZER_BODY=$(echo "$ANALYZER_RESPONSE" | sed '$d')
+
+                    if [ "$ANALYZER_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$ANALYZER_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+                        echo "    ✅ $ANALYZER_ID — created/updated (HTTP $ANALYZER_HTTP_CODE, attempt $PUT_ATTEMPT)"
+                        PUT_OK=true
+                        break
+                    fi
+
+                    # Retry on transient errors (401, 403, 429, 5xx)
+                    case "$ANALYZER_HTTP_CODE" in
+                        401|403|429|500|502|503|504)
+                            echo "    [attempt $PUT_ATTEMPT/$PUT_MAX_RETRIES] $ANALYZER_ID failed (HTTP $ANALYZER_HTTP_CODE) — retrying in ${PUT_BACKOFF}s..."
+                            sleep "$PUT_BACKOFF"
+                            PUT_BACKOFF=$((PUT_BACKOFF * 2))
+                            [ "$PUT_BACKOFF" -gt 120 ] && PUT_BACKOFF=120
+                            ;;
+                        *)
+                            echo "    ❌ $ANALYZER_ID — non-retryable error (HTTP $ANALYZER_HTTP_CODE)"
+                            echo "       Response: $ANALYZER_BODY"
+                            break
+                            ;;
+                    esac
+                done
+
+                if [ "$PUT_OK" = "true" ]; then
                     ANALYZER_SUCCESS=$((ANALYZER_SUCCESS + 1))
                 else
-                    echo "    ❌ $ANALYZER_ID — failed (HTTP $ANALYZER_HTTP_CODE)"
-                    echo "       Response: $ANALYZER_BODY"
+                    echo "    ❌ $ANALYZER_ID — failed after $PUT_MAX_RETRIES attempts"
                     ANALYZER_FAILED=$((ANALYZER_FAILED + 1))
                 fi
             done
@@ -179,6 +265,14 @@ else
             else
                 echo ""
                 echo "  Analyzers processed: $ANALYZER_COUNT (✅ $ANALYZER_SUCCESS succeeded, ❌ $ANALYZER_FAILED failed)"
+
+                # Fail deployment if ALL analyzers failed — partial success is allowed
+                if [ "$ANALYZER_FAILED" -gt 0 ] && [ "$ANALYZER_SUCCESS" -eq 0 ]; then
+                    echo ""
+                    echo "❌ All analyzer creations failed. Deployment cannot proceed."
+                    echo "   Re-run 'azd up' or 'azd hooks run postprovision' after verifying roles."
+                    exit 1
+                fi
             fi
         fi
     fi

From 892765fcc15f28355229c405808975db62c06185 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Wed, 27 May 2026 16:57:16 +0000
Subject: [PATCH 21/28] feat: replace fixed RBAC sleep with readiness probe and
 add retry logic to CU setup

---
 infra/scripts/post-provision.sh | 190 ++++++++++++++++++++++++--------
 1 file changed, 142 insertions(+), 48 deletions(-)

diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index a06ce71..7eab062 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -86,45 +86,101 @@ else
     CU_API_VERSION="2025-11-01"
     echo "CU Endpoint: $CU_ENDPOINT"
 
-    # Wait for RBAC role assignments to propagate before calling data-plane APIs.
-    # Azure RBAC propagation typically takes 1–5 minutes; without this wait the CU
-    # API calls immediately after role assignment will fail with HTTP 403.
-    echo "Waiting 90 seconds for RBAC role assignments to propagate..."
-    sleep 90
-
-    # Obtain a bearer token for Cognitive Services scope
-    echo "Acquiring access token..."
-    ACCESS_TOKEN=$(az account get-access-token \
-        --resource "https://cognitiveservices.azure.com" \
-        --query accessToken -o tsv 2>/dev/null || echo "")
-
-    if [ -z "$ACCESS_TOKEN" ]; then
-        echo "⚠️  Failed to acquire access token. Skipping CU setup."
-        echo "   Ensure the deployer identity has 'Cognitive Services User' role."
+    # --- Helper: acquire a bearer token for Cognitive Services scope ---
+    acquire_token() {
+        az account get-access-token \
+            --resource "https://cognitiveservices.azure.com" \
+            --query accessToken -o tsv 2>/dev/null || echo ""
+    }
+
+    # --- RBAC Readiness Probe ---
+    # Instead of a fixed sleep, poll the CU data-plane until RBAC propagates.
+    # Retries every 30s for up to 10 minutes (20 attempts).
+    echo "Probing CU data-plane for RBAC readiness (up to 10 minutes)..."
+    RBAC_MAX_ATTEMPTS=20
+    RBAC_WAIT_SECONDS=30
+    RBAC_READY=false
+    ACCESS_TOKEN=""
+
+    for RBAC_ATTEMPT in $(seq 1 $RBAC_MAX_ATTEMPTS); do
+        ACCESS_TOKEN=$(acquire_token)
+        if [ -z "$ACCESS_TOKEN" ]; then
+            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] Failed to acquire token — retrying in ${RBAC_WAIT_SECONDS}s..."
+            sleep "$RBAC_WAIT_SECONDS"
+            continue
+        fi
+
+        PROBE_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
+            "${CU_ENDPOINT}/contentunderstanding/analyzers?api-version=${CU_API_VERSION}" \
+            -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null)
+
+        if [ "$PROBE_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$PROBE_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+            echo "  ✅ RBAC is active (HTTP $PROBE_HTTP_CODE on attempt $RBAC_ATTEMPT)"
+            RBAC_READY=true
+            break
+        else
+            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] RBAC not ready (HTTP $PROBE_HTTP_CODE) — retrying in ${RBAC_WAIT_SECONDS}s..."
+            sleep "$RBAC_WAIT_SECONDS"
+        fi
+    done
+
+    if [ "$RBAC_READY" != "true" ]; then
+        echo "❌ RBAC did not propagate within $((RBAC_MAX_ATTEMPTS * RBAC_WAIT_SECONDS)) seconds."
+        echo "   Re-run 'azd up' or 'azd hooks run postprovision' after a few minutes."
+        exit 1
     else
-        # --- Step 1: Set default model deployments ---
+        # --- Step 1: Set default model deployments (with retry) ---
         echo ""
         echo "[CU-1] Setting default model deployments..."
-        CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
-            "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
-            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-            -H "Content-Type: application/merge-patch+json" \
-            -d '{
-                "modelDeployments": {
-                    "gpt-4.1": "gpt-4.1",
-                    "gpt-4.1-mini": "gpt-4.1-mini",
-                    "text-embedding-3-large": "text-embedding-3-large"
-                }
-            }' 2>/dev/null)
-
-        CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
-        CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
-
-        if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-            echo "  ✅ Default model deployments configured successfully"
-        else
-            echo "  ⚠️  Failed to set CU defaults (HTTP $CU_DEFAULTS_HTTP_CODE)"
-            echo "     Response: $CU_DEFAULTS_BODY"
+        DEFAULTS_MAX_RETRIES=5
+        DEFAULTS_BACKOFF=15
+        DEFAULTS_OK=false
+
+        for DEFAULTS_ATTEMPT in $(seq 1 $DEFAULTS_MAX_RETRIES); do
+            # Refresh token before each attempt (handles expiry edge case)
+            if [ "$DEFAULTS_ATTEMPT" -gt 1 ]; then
+                ACCESS_TOKEN=$(acquire_token)
+            fi
+
+            CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
+                "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
+                -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                -H "Content-Type: application/merge-patch+json" \
+                -d '{
+                    "modelDeployments": {
+                        "gpt-4.1": "gpt-4.1",
+                        "gpt-4.1-mini": "gpt-4.1-mini",
+                        "text-embedding-3-large": "text-embedding-3-large"
+                    }
+                }' 2>/dev/null)
+
+            CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
+            CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
+
+            if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+                echo "  ✅ Default model deployments configured successfully (attempt $DEFAULTS_ATTEMPT)"
+                DEFAULTS_OK=true
+                break
+            fi
+
+            # Retry on transient errors (401, 403, 429, 5xx)
+            case "$CU_DEFAULTS_HTTP_CODE" in
+                401|403|429|500|502|503|504)
+                    echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_RETRIES] CU defaults failed (HTTP $CU_DEFAULTS_HTTP_CODE) — retrying in ${DEFAULTS_BACKOFF}s..."
+                    sleep "$DEFAULTS_BACKOFF"
+                    DEFAULTS_BACKOFF=$((DEFAULTS_BACKOFF * 2))
+                    [ "$DEFAULTS_BACKOFF" -gt 120 ] && DEFAULTS_BACKOFF=120
+                    ;;
+                *)
+                    echo "  ⚠️  CU defaults failed with non-retryable error (HTTP $CU_DEFAULTS_HTTP_CODE)"
+                    echo "     Response: $CU_DEFAULTS_BODY"
+                    break
+                    ;;
+            esac
+        done
+
+        if [ "$DEFAULTS_OK" != "true" ]; then
+            echo "  ⚠️  Failed to set CU defaults after $DEFAULTS_MAX_RETRIES attempts."
             echo "     Model deployments may not be available yet. Run post-provision again after models are ready."
         fi
 
@@ -152,22 +208,52 @@ else
 
                 echo "  Creating analyzer: $ANALYZER_ID ..."
 
-                # PUT is create-or-replace (idempotent)
-                ANALYZER_RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT \
-                    "${CU_ENDPOINT}/contentunderstanding/analyzers/${ANALYZER_ID}?api-version=${CU_API_VERSION}" \
-                    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-                    -H "Content-Type: application/json" \
-                    -d @"$ANALYZER_FILE" 2>/dev/null)
+                # PUT is create-or-replace (idempotent) — retry with exponential backoff
+                PUT_MAX_RETRIES=5
+                PUT_BACKOFF=15
+                PUT_OK=false
+
+                for PUT_ATTEMPT in $(seq 1 $PUT_MAX_RETRIES); do
+                    # Refresh token before each retry (handles expiry edge case)
+                    if [ "$PUT_ATTEMPT" -gt 1 ]; then
+                        ACCESS_TOKEN=$(acquire_token)
+                    fi
 
-                ANALYZER_HTTP_CODE=$(echo "$ANALYZER_RESPONSE" | tail -1)
-                ANALYZER_BODY=$(echo "$ANALYZER_RESPONSE" | sed '$d')
+                    ANALYZER_RESPONSE=$(curl -s -w "\n%{http_code}" -X PUT \
+                        "${CU_ENDPOINT}/contentunderstanding/analyzers/${ANALYZER_ID}?api-version=${CU_API_VERSION}" \
+                        -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                        -H "Content-Type: application/json" \
+                        -d @"$ANALYZER_FILE" 2>/dev/null)
 
-                if [ "$ANALYZER_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$ANALYZER_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-                    echo "    ✅ $ANALYZER_ID — created/updated (HTTP $ANALYZER_HTTP_CODE)"
+                    ANALYZER_HTTP_CODE=$(echo "$ANALYZER_RESPONSE" | tail -1)
+                    ANALYZER_BODY=$(echo "$ANALYZER_RESPONSE" | sed '$d')
+
+                    if [ "$ANALYZER_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$ANALYZER_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+                        echo "    ✅ $ANALYZER_ID — created/updated (HTTP $ANALYZER_HTTP_CODE, attempt $PUT_ATTEMPT)"
+                        PUT_OK=true
+                        break
+                    fi
+
+                    # Retry on transient errors (401, 403, 429, 5xx)
+                    case "$ANALYZER_HTTP_CODE" in
+                        401|403|429|500|502|503|504)
+                            echo "    [attempt $PUT_ATTEMPT/$PUT_MAX_RETRIES] $ANALYZER_ID failed (HTTP $ANALYZER_HTTP_CODE) — retrying in ${PUT_BACKOFF}s..."
+                            sleep "$PUT_BACKOFF"
+                            PUT_BACKOFF=$((PUT_BACKOFF * 2))
+                            [ "$PUT_BACKOFF" -gt 120 ] && PUT_BACKOFF=120
+                            ;;
+                        *)
+                            echo "    ❌ $ANALYZER_ID — non-retryable error (HTTP $ANALYZER_HTTP_CODE)"
+                            echo "       Response: $ANALYZER_BODY"
+                            break
+                            ;;
+                    esac
+                done
+
+                if [ "$PUT_OK" = "true" ]; then
                     ANALYZER_SUCCESS=$((ANALYZER_SUCCESS + 1))
                 else
-                    echo "    ❌ $ANALYZER_ID — failed (HTTP $ANALYZER_HTTP_CODE)"
-                    echo "       Response: $ANALYZER_BODY"
+                    echo "    ❌ $ANALYZER_ID — failed after $PUT_MAX_RETRIES attempts"
                     ANALYZER_FAILED=$((ANALYZER_FAILED + 1))
                 fi
             done
@@ -177,6 +263,14 @@ else
             else
                 echo ""
                 echo "  Analyzers processed: $ANALYZER_COUNT (✅ $ANALYZER_SUCCESS succeeded, ❌ $ANALYZER_FAILED failed)"
+
+                # Fail deployment if ALL analyzers failed — partial success is allowed
+                if [ "$ANALYZER_FAILED" -gt 0 ] && [ "$ANALYZER_SUCCESS" -eq 0 ]; then
+                    echo ""
+                    echo "❌ All analyzer creations failed. Deployment cannot proceed."
+                    echo "   Re-run 'azd up' or 'azd hooks run postprovision' after verifying roles."
+                    exit 1
+                fi
             fi
         fi
     fi

From 352537cb06687c402f02fb892cd5dceb59b0f2c5 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Thu, 28 May 2026 11:18:06 +0000
Subject: [PATCH 22/28] feat: extend RBAC readiness probe timeout from 10 to 30
 minutes

---
 infra/scripts/post-provision.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index 9f25446..b045eda 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -97,9 +97,9 @@ else
 
     # --- RBAC Readiness Probe ---
     # Instead of a fixed sleep, poll the CU data-plane until RBAC propagates.
-    # Retries every 30s for up to 10 minutes (20 attempts).
-    echo "Probing CU data-plane for RBAC readiness (up to 10 minutes)..."
-    RBAC_MAX_ATTEMPTS=20
+    # Retries every 30s for up to 30 minutes (60 attempts).
+    echo "Probing CU data-plane for RBAC readiness (up to 30 minutes)..."
+    RBAC_MAX_ATTEMPTS=60
     RBAC_WAIT_SECONDS=30
     RBAC_READY=false
     ACCESS_TOKEN=""

From c3342307ddbbc88e6fc78b21444572fca92b1a28 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Thu, 28 May 2026 11:18:06 +0000
Subject: [PATCH 23/28] feat: extend RBAC readiness probe timeout from 10 to 30
 minutes

---
 infra/scripts/post-provision.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index 7eab062..2beae6e 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -95,9 +95,9 @@ else
 
     # --- RBAC Readiness Probe ---
     # Instead of a fixed sleep, poll the CU data-plane until RBAC propagates.
-    # Retries every 30s for up to 10 minutes (20 attempts).
-    echo "Probing CU data-plane for RBAC readiness (up to 10 minutes)..."
-    RBAC_MAX_ATTEMPTS=20
+    # Retries every 30s for up to 30 minutes (60 attempts).
+    echo "Probing CU data-plane for RBAC readiness (up to 30 minutes)..."
+    RBAC_MAX_ATTEMPTS=60
     RBAC_WAIT_SECONDS=30
     RBAC_READY=false
     ACCESS_TOKEN=""

From aebc356ff4a9a2bd1c0e8bdc4dc485c07112e238 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Thu, 28 May 2026 21:00:27 +0000
Subject: [PATCH 24/28] refactor: remove worker service and clean up dead code

- Delete contentflow-worker/ directory (18 files, ~3400 lines)
- Delete infra/bicep/main.json (stale 51K-line compiled ARM template)
- Delete infra/scripts/post-deploy-worker.sh
- Remove worker service definition from azure.yaml
- Remove worker-related settings from API (settings.py, dependencies.py)
- Remove worker health checks from health_service.py
- Remove worker status indicator from Footer.tsx
- Remove worker field from apiTypes.ts HealthCheck interface
- Remove worker queue creation from post-provision.sh
- Remove worker config from .env.template
- Clean up commented-out worker blocks from main.bicep (~160 lines)
- Revert text-embedding-3-large model deployment to active in ai-foundry.bicep
- Clean up ailz-resources.env and post-deploy.sh references
---
 .env.template                                 |    22 -
 azure.yaml                                    |    13 -
 contentflow-api/app/dependencies.py           |     5 +-
 .../app/services/health_service.py            |   153 +-
 contentflow-api/app/settings.py               |     9 -
 contentflow-web/src/components/Footer.tsx     |    13 -
 contentflow-web/src/lib/api/apiTypes.ts       |     1 -
 contentflow-worker/.env.example               |    50 -
 contentflow-worker/.gitignore                 |    76 -
 contentflow-worker/Dockerfile                 |    42 -
 contentflow-worker/README.md                  |   411 -
 contentflow-worker/__init__.py                |    28 -
 contentflow-worker/app/__init__.py            |     0
 contentflow-worker/app/api.py                 |   130 -
 contentflow-worker/app/engine.py              |   237 -
 contentflow-worker/app/models.py              |   111 -
 contentflow-worker/app/queue_client.py        |   236 -
 contentflow-worker/app/settings.py            |   176 -
 contentflow-worker/app/startup.py             |   225 -
 contentflow-worker/app/utils.py               |   182 -
 contentflow-worker/app/worker/__init__.py     |     0
 .../app/worker/processing_worker.py           |   482 -
 .../app/worker/source_worker.py               |   853 -
 contentflow-worker/main.py                    |   116 -
 contentflow-worker/requirements.txt           |    17 -
 infra/bicep/main.bicep                        |   160 -
 infra/bicep/main.json                         | 51165 ----------------
 infra/bicep/modules/ai-foundry.bicep          |     2 +-
 infra/scripts/ailz-resources.env              |    26 +-
 infra/scripts/post-deploy-worker.sh           |    13 -
 infra/scripts/post-deploy.sh                  |     2 -
 infra/scripts/post-provision.sh               |    10 -
 32 files changed, 17 insertions(+), 54949 deletions(-)
 delete mode 100644 contentflow-worker/.env.example
 delete mode 100644 contentflow-worker/.gitignore
 delete mode 100644 contentflow-worker/Dockerfile
 delete mode 100644 contentflow-worker/README.md
 delete mode 100644 contentflow-worker/__init__.py
 delete mode 100644 contentflow-worker/app/__init__.py
 delete mode 100644 contentflow-worker/app/api.py
 delete mode 100644 contentflow-worker/app/engine.py
 delete mode 100644 contentflow-worker/app/models.py
 delete mode 100644 contentflow-worker/app/queue_client.py
 delete mode 100644 contentflow-worker/app/settings.py
 delete mode 100644 contentflow-worker/app/startup.py
 delete mode 100644 contentflow-worker/app/utils.py
 delete mode 100644 contentflow-worker/app/worker/__init__.py
 delete mode 100644 contentflow-worker/app/worker/processing_worker.py
 delete mode 100644 contentflow-worker/app/worker/source_worker.py
 delete mode 100644 contentflow-worker/main.py
 delete mode 100644 contentflow-worker/requirements.txt
 delete mode 100644 infra/bicep/main.json
 delete mode 100755 infra/scripts/post-deploy-worker.sh

diff --git a/.env.template b/.env.template
index 58601f4..65c7db6 100644
--- a/.env.template
+++ b/.env.template
@@ -15,8 +15,6 @@ AZURE_LOCATION=eastus2
 COSMOS_DB_ENDPOINT=
 COSMOS_DB_NAME=contentflow
 STORAGE_ACCOUNT_NAME=
-STORAGE_ACCOUNT_WORKER_QUEUE_URL=
-STORAGE_WORKER_QUEUE_NAME=contentflow-execution-requests
 BLOB_STORAGE_CONTAINER_NAME=content
 APP_CONFIG_ENDPOINT=
 APPLICATIONINSIGHTS_CONNECTION_STRING=
@@ -33,26 +31,6 @@ API_SERVER_PORT=8090
 DEBUG=false
 LOG_LEVEL=INFO
 
-# ==============================================
-# Worker Configuration
-# ==============================================
-NUM_PROCESSING_WORKERS=4
-NUM_SOURCE_WORKERS=2
-WORKER_NAME=contentflow-worker
-LOG_LEVEL=INFO
-
-# Queue Settings
-QUEUE_POLL_INTERVAL_SECONDS=5
-QUEUE_VISIBILITY_TIMEOUT_SECONDS=300
-QUEUE_MAX_MESSAGES=32
-DEFAULT_POLLING_INTERVAL_SECONDS=300
-SCHEDULER_SLEEP_INTERVAL_SECONDS=5
-LOCK_TTL_SECONDS=300
-
-# Processing Settings
-MAX_TASK_RETRIES=3
-TASK_TIMEOUT_SECONDS=600
-
 # ==============================================
 # Web Configuration
 # ==============================================
diff --git a/azure.yaml b/azure.yaml
index ab4e0de..bb9e689 100644
--- a/azure.yaml
+++ b/azure.yaml
@@ -24,19 +24,6 @@ services:
       target: ""
       remoteBuild: false
 
-  # --- WORKER DISABLED: uncomment to re-enable worker deployment ---
-  # # ContentFlow Worker - Container App
-  # worker:
-  #   project: ./contentflow-worker
-  #   language: python
-  #   host: containerapp
-  #   docker:
-  #     path: ./Dockerfile
-  #     context: ..
-  #     target: ""
-  #     remoteBuild: false
-  # --- END WORKER DISABLED ---
-
   # ContentFlow Web - Container App
   web:
     project: ./contentflow-web
diff --git a/contentflow-api/app/dependencies.py b/contentflow-api/app/dependencies.py
index 60bd1b4..4e8743e 100644
--- a/contentflow-api/app/dependencies.py
+++ b/contentflow-api/app/dependencies.py
@@ -55,10 +55,7 @@ def get_health_service():
                          cosmos_db_name=app_settings.COSMOS_DB_NAME,
                          cosmos_db_containers=app_settings.get_cosmos_db_containers(),
                          blob_storage_account=app_settings.BLOB_STORAGE_ACCOUNT_NAME,
-                         blob_storage_container=app_settings.BLOB_STORAGE_CONTAINER_NAME,
-                         storage_account_worker_queue_url=app_settings.STORAGE_ACCOUNT_WORKER_QUEUE_URL,
-                         storage_worker_queue_name=app_settings.STORAGE_WORKER_QUEUE_NAME,
-                         worker_engine_api_endpoint=app_settings.WORKER_ENGINE_API_ENDPOINT)
+                         blob_storage_container=app_settings.BLOB_STORAGE_CONTAINER_NAME)
 
 @ttl_cache(ttl=__cache_ttl)  # Cache for 10 minutes
 async def get_pipeline_service():
diff --git a/contentflow-api/app/services/health_service.py b/contentflow-api/app/services/health_service.py
index de17923..e41c23a 100644
--- a/contentflow-api/app/services/health_service.py
+++ b/contentflow-api/app/services/health_service.py
@@ -10,7 +10,6 @@
 from pydantic import BaseModel
 
 from azure.cosmos import CosmosClient
-from azure.storage.queue import QueueServiceClient
 from azure.appconfiguration import AzureAppConfigurationClient
 from azure.core.exceptions import ResourceNotFoundError
 
@@ -44,22 +43,15 @@ def __init__(self,
                  cosmos_db_name: str = None,
                  cosmos_db_containers: List[str] = None,
                  blob_storage_account: str = None,
-                 blob_storage_container: str = None,
-                 storage_account_worker_queue_url: str = None,
-                 storage_worker_queue_name: str = None,
-                 worker_engine_api_endpoint: str = None):
+                 blob_storage_container: str = None):
         
         self.cosmos_endpoint = cosmos_endpoint
         self.cosmos_db_name = cosmos_db_name
         self.cosmos_db_containers = cosmos_db_containers
         self.blob_storage_account = blob_storage_account
         self.blob_storage_container = blob_storage_container
-        self.storage_account_worker_queue_url = storage_account_worker_queue_url
-        self.storage_worker_queue_name = storage_worker_queue_name
-        self.worker_engine_api_endpoint = worker_engine_api_endpoint
         
         self.cosmos_client: Optional[CosmosClient] = None
-        self.queue_client: Optional[QueueServiceClient] = None
         self.app_config_client: Optional[AzureAppConfigurationClient] = None
         
         credential, token_details = get_azure_credential_with_details()
@@ -75,12 +67,10 @@ async def check_all_services(self) -> SystemHealth:
             self._check_app_config_health(),
             self._check_cosmos_db_health(),
             self._check_blob_storage_health(),
-            self._check_storage_queue_health(),
-            self._check_worker_health(),
             return_exceptions=True
         )
         
-        service_names = ["app_config", "cosmos_db", "blob_storage", "storage_queue", "worker"]
+        service_names = ["app_config", "cosmos_db", "blob_storage"]
         
         for i, result in enumerate(results):
             if isinstance(result, Exception):
@@ -272,85 +262,6 @@ async def _check_blob_storage_health(self) -> ServiceHealth:
                 endpoint=f"https://{self.blob_storage_account}.blob.core.windows.net"
             )
     
-    async def _check_storage_queue_health(self) -> ServiceHealth:
-        """Check Azure Storage Queue connection health"""
-        start_time = datetime.now(timezone.utc)
-        
-        try:
-
-            logger.debug(f"Checking storage queue health with URL: {self.storage_account_worker_queue_url} and queue name: {self.storage_worker_queue_name}")
-
-            if not self.storage_account_worker_queue_url:
-                return ServiceHealth(
-                    name="storage_queue",
-                    status="error",
-                    message="Storage queue URL not configured",
-                    error="Storage queue URL not configured in Azure App Configuration. Ensure 'STORAGE_ACCOUNT_WORKER_QUEUE_URL' is set using the correct key prefix.",
-                    last_checked=datetime.now(timezone.utc).isoformat(),
-                    endpoint="Not configured"
-                )
-            
-            credential, token_details = (self.credential, self.token_details)
-            if not credential or not token_details:
-                credential, token_details = get_azure_credential_with_details()
-                
-            # Create client if not exists
-            if not self.queue_client:
-                # Extract account URL from queue URL
-                account_url = self.storage_account_worker_queue_url
-                
-                self.queue_client = QueueServiceClient(
-                    account_url=account_url,
-                    credential=credential
-                )
-            
-            # Try to get queue properties
-            queue_client = self.queue_client.get_queue_client(self.storage_worker_queue_name)
-            properties = queue_client.get_queue_properties()
-
-            response_time = int((datetime.now(timezone.utc) - start_time).total_seconds() * 1000)
-
-            return ServiceHealth(
-                name="storage_queue",
-                status="connected",
-                message="Connected successfully",
-                details={
-                    "queue_name": self.storage_worker_queue_name,
-                    "approximate_message_count": properties.approximate_message_count,
-                    "metadata": properties.metadata,
-                    "credential_type": "default_azure_credential",
-                    "credential_details": token_details
-                },
-                response_time_ms=response_time,
-                last_checked=datetime.now(timezone.utc).isoformat(),
-                endpoint=self.storage_account_worker_queue_url
-            )
-            
-        except ResourceNotFoundError:
-            response_time = int((datetime.now(timezone.utc) - start_time).total_seconds() * 1000)
-            return ServiceHealth(
-                name="storage_queue",
-                status="error",
-                message=f"Queue '{self.storage_worker_queue_name}' not found",
-                error=f"Queue '{self.storage_worker_queue_name}' not found",
-                details={"error_type": "ResourceNotFoundError"},
-                response_time_ms=response_time,
-                last_checked=datetime.now(timezone.utc).isoformat(),
-                endpoint=self.storage_account_worker_queue_url
-            )
-        except Exception as e:
-            response_time = int((datetime.now(timezone.utc) - start_time).total_seconds() * 1000)
-            return ServiceHealth(
-                name="storage_queue",
-                status="error",
-                message=f"Connection failed: {e.__class__.__name__}",
-                error=f'{str(e)}',
-                details={"error_type": type(e).__name__},
-                response_time_ms=response_time,
-                last_checked=datetime.now(timezone.utc).isoformat(),
-                endpoint=self.storage_account_worker_queue_url
-            )
-    
     async def _check_app_config_health(self) -> ServiceHealth:
         """Check Azure App Configuration connection health"""
         start_time = datetime.now(timezone.utc)
@@ -424,74 +335,14 @@ async def _check_app_config_health(self) -> ServiceHealth:
                 endpoint=endpoint or connection_string or "Not configured"
             )
     
-    async def _check_worker_health(self) -> ServiceHealth:
-        """Check worker service health by querying the worker FastAPI health endpoint via aiohttp."""
-        import aiohttp
-        
-        start_time = datetime.now(timezone.utc)
-        endpoint = self.worker_engine_api_endpoint
-        url = endpoint.rstrip("/") + "/status"
-        
-        logger.debug(f"Checking worker health with URL: {url}")
-        
-        try:
-            async with aiohttp.ClientSession() as session:
-                async with session.get(url, timeout=5) as resp:
-                    response_time = int((datetime.now(timezone.utc) - start_time).total_seconds() * 1000)
-                    if resp.status == 200:
-                        data = await resp.json()
-                        return ServiceHealth(
-                            name="worker",
-                            status="connected",
-                            message="Worker engine is running",
-                            details={
-                                "status": data.get("running"),
-                                "worker_name": data.get("worker_name"),
-                                "timestamp": data.get("timestamp"),
-                                "processing_workers": data.get("processing_workers"),
-                                "source_workers": data.get("source_workers")
-                            },
-                            response_time_ms=response_time,
-                            last_checked=datetime.now(timezone.utc).isoformat(),
-                            endpoint=self.worker_engine_api_endpoint
-                        )
-                    else:
-                        text = await resp.text()
-                        return ServiceHealth(
-                            name="worker",
-                            status="error",
-                            message=f"Worker health endpoint returned status {resp.status}",
-                            error=text,
-                            details={"http_status": resp.status},
-                            response_time_ms=response_time,
-                            last_checked=datetime.now(timezone.utc).isoformat(),
-                            endpoint=url
-                        )
-        except Exception as e:
-            response_time = int((datetime.now(timezone.utc) - start_time).total_seconds() * 1000)
-            return ServiceHealth(
-                name="worker",
-                status="error",
-                message=f"Worker health check failed: {e.__class__.__name__}",
-                error=f'{str(e)}',
-                details={"error_type": type(e).__name__},
-                response_time_ms=response_time,
-                last_checked=datetime.now(timezone.utc).isoformat(),
-                endpoint=url
-            )
-    
     async def check_service_health(self, service_name: str) -> ServiceHealth:
         """Check the health of a specific service"""
         if service_name == "cosmos_db":
             return await self._check_cosmos_db_health()
-        elif service_name == "storage_queue":
-            return await self._check_storage_queue_health()
         elif service_name == "app_config":
             return await self._check_app_config_health()
         elif service_name == "blob_storage":
             return await self._check_blob_storage_health()
-        elif service_name == "worker":
-            return await self._check_worker_health()
         else:
             return ServiceHealth(
                 name=service_name,
diff --git a/contentflow-api/app/settings.py b/contentflow-api/app/settings.py
index 06bbf0a..be34f13 100644
--- a/contentflow-api/app/settings.py
+++ b/contentflow-api/app/settings.py
@@ -57,12 +57,6 @@ class AppSettings(BaseModel):
     # Azure Storage Blob settings
     BLOB_STORAGE_ACCOUNT_NAME: str = ""
     BLOB_STORAGE_CONTAINER_NAME: str = "content"
-    
-    # Azure Storage Queue settings
-    STORAGE_ACCOUNT_WORKER_QUEUE_URL: str = ""
-    STORAGE_WORKER_QUEUE_NAME: str = "contentflow-execution-requests"
-
-    WORKER_ENGINE_API_ENDPOINT: str = "http://localhost:8099"
 
     # Ingest API settings
     INGEST_PIPELINE_NAME: str = "Details extraction and validation pipeline"
@@ -97,9 +91,6 @@ def _load_from_app_config(self):
                 "COSMOS_DB_NAME",
                 "BLOB_STORAGE_ACCOUNT_NAME",
                 "BLOB_STORAGE_CONTAINER_NAME",
-                "STORAGE_ACCOUNT_WORKER_QUEUE_URL",
-                "STORAGE_WORKER_QUEUE_NAME",
-                "WORKER_ENGINE_API_ENDPOINT",
                 "API_SERVER_HOST",
                 "API_SERVER_PORT",
                 "API_SERVER_WORKERS",
diff --git a/contentflow-web/src/components/Footer.tsx b/contentflow-web/src/components/Footer.tsx
index d6e3887..02c1af0 100644
--- a/contentflow-web/src/components/Footer.tsx
+++ b/contentflow-web/src/components/Footer.tsx
@@ -154,14 +154,12 @@ interface SystemHealth {
   cosmosDB: "connected" | "offline";
   blobStorage: "connected" | "offline";
   storageQueue: "connected" | "offline";
-  worker?: "connected" | "offline";
   lastChecked: Date;
   serviceDetails: {
     appConfig?: ServiceStatus;
     cosmosDB?: ServiceStatus;
     blobStorage?: ServiceStatus;
     storageQueue?: ServiceStatus;
-    worker?: ServiceStatus;
   };
 }
 
@@ -173,7 +171,6 @@ export const Footer = () => {
     cosmosDB: "offline",
     blobStorage: "offline",
     storageQueue: "offline",
-    worker: "offline",
     lastChecked: new Date(),
     serviceDetails: {},
   });
@@ -192,14 +189,12 @@ export const Footer = () => {
         cosmosDB: healthData.services.cosmos_db?.status === "connected" ? "connected" : "offline",
         blobStorage: healthData.services.blob_storage?.status === "connected" ? "connected" : "offline",
         storageQueue: healthData.services.storage_queue?.status === "connected" ? "connected" : "offline",
-        worker: healthData.services.worker?.status === "connected" ? "connected" : "offline",
         lastChecked: new Date(),
         serviceDetails: {
           appConfig: healthData.services.app_config,
           cosmosDB: healthData.services.cosmos_db,
           blobStorage: healthData.services.blob_storage,
           storageQueue: healthData.services.storage_queue,
-          worker: healthData.services.worker,
         },
       });
     } catch (error) {
@@ -210,7 +205,6 @@ export const Footer = () => {
         cosmosDB: "offline",
         blobStorage: "offline",
         storageQueue: "offline",
-        worker: "offline",
         lastChecked: new Date(),
         serviceDetails: {},
       });
@@ -343,13 +337,6 @@ export const Footer = () => {
                   getStatusColor={getStatusColor}
                 />
 
-                <ServiceHealthItem
-                  name="Worker Engine"
-                  status={systemHealth.worker}
-                  serviceStatus={systemHealth.serviceDetails.worker}
-                  getStatusColor={getStatusColor}
-                />
-
                 <div className="pt-4 border-t border-border">
                   <div className="flex items-center justify-between text-xs text-muted-foreground">
                     <span>Last checked:</span>
diff --git a/contentflow-web/src/lib/api/apiTypes.ts b/contentflow-web/src/lib/api/apiTypes.ts
index 45b65c5..bf85f4f 100644
--- a/contentflow-web/src/lib/api/apiTypes.ts
+++ b/contentflow-web/src/lib/api/apiTypes.ts
@@ -33,7 +33,6 @@ export interface HealthCheck {
     cosmos_db?: ServiceStatus;
     blob_storage?: ServiceStatus;
     storage_queue?: ServiceStatus;
-    worker?: ServiceStatus;
   };
 }
 
diff --git a/contentflow-worker/.env.example b/contentflow-worker/.env.example
deleted file mode 100644
index f4d6509..0000000
--- a/contentflow-worker/.env.example
+++ /dev/null
@@ -1,50 +0,0 @@
-# ContentFlow Worker Environment Configuration
-
-# Azure App Configuration
-AZURE_APP_CONFIG_ENDPOINT=https://your-app-config-resource.azconfig.io
-APP_CONFIG_KEY_FILTERS=contentflow.worker.*
-
-# Worker Settings
-WORKER_NAME=contentflow-worker
-NUM_PROCESSING_WORKERS=2
-NUM_SOURCE_WORKERS=2
-
-# Azure Storage Queue
-STORAGE_ACCOUNT_WORKER_QUEUE_URL=https://your-storage-account.queue.core.windows.net
-STORAGE_WORKER_QUEUE_NAME=contentflow-execution-requests
-
-# Queue Polling Settings
-QUEUE_POLL_INTERVAL_SECONDS=5
-QUEUE_VISIBILITY_TIMEOUT_SECONDS=300
-QUEUE_MAX_MESSAGES=32
-
-# Processing Settings
-MAX_TASK_RETRIES=3
-TASK_TIMEOUT_SECONDS=600
-
-# Azure Cosmos DB
-COSMOS_DB_ENDPOINT=
-COSMOS_DB_NAME=contentflow
-COSMOS_DB_CONTAINER_PIPELINES=pipelines
-COSMOS_DB_CONTAINER_VAULT_EXECUTIONS=vault_executions
-COSMOS_DB_CONTAINER_VAULTS=vaults
-COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS=vault_exec_locks
-COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS=vault_crawl_checkpoints
-
-# Azure Blob Storage
-BLOB_STORAGE_ACCOUNT_NAME=your-storage-account
-BLOB_STORAGE_CONTAINER_NAME=content
-
-# Source Worker Settings
-SOURCE_WORKER_POLL_INTERVAL_SECONDS=60  # Deprecated: use per-executor polling_interval_seconds
-DEFAULT_POLLING_INTERVAL_SECONDS=300    # Default 5 minutes if executor doesn't specify
-SCHEDULER_SLEEP_INTERVAL_SECONDS=5      # How often scheduler checks for ready pipelines
-LOCK_TTL_SECONDS=300                    # Distributed lock TTL (5 minutes)
-
-API_ENABLED=true
-API_HOST=0.0.0.0
-API_PORT=8099
-
-# Logging
-LOG_LEVEL=DEBUG
-DEBUG=true
\ No newline at end of file
diff --git a/contentflow-worker/.gitignore b/contentflow-worker/.gitignore
deleted file mode 100644
index c2e9c0d..0000000
--- a/contentflow-worker/.gitignore
+++ /dev/null
@@ -1,76 +0,0 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-.Python
-build/
-develop-eggs/
-dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-pip-wheel-metadata/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
-
-# PyInstaller
-*.manifest
-*.spec
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py,cover
-.hypothesis/
-.pytest_cache/
-
-# Environments
-.env
-.venv
-env/
-venv/
-ENV/
-env.bak/
-venv.bak/
-
-# IDEs
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-
-# Logs
-*.log
-worker.log
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Temporary files
-*.tmp
-*.temp
-
-/tmp
\ No newline at end of file
diff --git a/contentflow-worker/Dockerfile b/contentflow-worker/Dockerfile
deleted file mode 100644
index 68f4d61..0000000
--- a/contentflow-worker/Dockerfile
+++ /dev/null
@@ -1,42 +0,0 @@
-# ContentFlow Worker - Multi-processing Content Processing Engine
-FROM python:3.13-slim
-
-# Set working directory
-WORKDIR /app
-
-# Install system dependencies
-RUN apt-get update && apt-get install -y \
-    gcc \
-    g++ \
-    && rm -rf /var/lib/apt/lists/*
-
-# Copy contentflow-lib first (shared dependency)
-COPY contentflow-lib /app/contentflow-lib
-
-# Install contentflow-lib
-WORKDIR /app/contentflow-lib
-RUN pip install --no-cache-dir -e .
-
-# Switch to Worker directory
-WORKDIR /app/contentflow-worker
-
-# Copy Worker requirements
-COPY contentflow-worker/requirements.txt .
-
-# Install Python dependencies
-RUN pip install --no-cache-dir -r requirements.txt
-
-# Copy worker code
-COPY contentflow-worker/ .
-
-# # Set Python path to include contentflow-lib
-# ENV PYTHONPATH="/app:/app/contentflow-lib:${PYTHONPATH}"
-
-# Environment variables (can be overridden)
-ENV WORKER_NAME=contentflow-worker
-ENV NUM_PROCESSING_WORKERS=4
-ENV NUM_SOURCE_WORKERS=2
-ENV LOG_LEVEL=INFO
-
-# Run the worker
-CMD ["python", "main.py"]
diff --git a/contentflow-worker/README.md b/contentflow-worker/README.md
deleted file mode 100644
index d7ed312..0000000
--- a/contentflow-worker/README.md
+++ /dev/null
@@ -1,411 +0,0 @@
-# ContentFlow Worker
-
-Multi-processing based worker engine for processing content through ContentFlow pipelines.
-
-## Table of Contents
-
-- [Overview](#overview)
-- [Architecture](#architecture)
-- [Components](#components)
-- [Configuration](#configuration)
-- [Installation](#installation)
-- [Usage](#usage)
-- [Task Types](#task-types)
-- [Workflow](#workflow)
-- [Sending Tasks to the Queue](#sending-tasks-to-the-queue)
-- [Monitoring](#monitoring)
-- [Features](#features)
-- [Error Handling](#error-handling)
-- [Performance Tuning](#performance-tuning)
-- [Requirements](#requirements)
-
-## Overview
-
-The ContentFlow Worker is a distributed, multi-processing engine designed to:
-- Process content items through ContentFlow pipelines
-- Discover content from input sources (Azure Blob Storage, etc.)
-- Scale processing across multiple worker processes
-- Handle task queuing, retries, and fault tolerance
-
-## Architecture
-
-The worker engine consists of two types of worker processes:
-
-### 1. Content Processing Workers
-- Listen to the Azure Storage Queue for processing tasks
-- Execute ContentFlow pipelines on content items (excluding already-executed input executors)
-- Report execution status to Cosmos DB
-- Handle task retries and error recovery
-
-### 2. Input Source Workers
-- Poll Cosmos DB for enabled pipelines associated with vaults
-- Parse pipeline configuration to identify input executors
-- Execute input executors to discover content from sources
-- Create processing tasks for discovered content items
-- Queue tasks for processing workers
-
-## Components
-
-```
-contentflow-worker/
-├── app/
-│   ├── __init__.py
-│   ├── api.py             # FastAPI health and status monitoring
-│   ├── engine.py          # Main worker engine (manages processes)
-│   ├── models.py          # Task models (Pydantic)
-│   ├── queue_client.py    # Azure Storage Queue wrapper
-│   ├── settings.py        # Configuration and settings
-│   ├── startup.py         # Application startup
-│   ├── utils.py           # Utility functions
-│   └── worker/
-│       ├── __init__.py
-│       ├── processing_worker.py   # Content processing worker
-│       └── source_worker.py       # Input source loading worker
-├── main.py                # Entry point
-├── Dockerfile             # Docker container configuration
-├── requirements.txt       # Python dependencies
-├── .env                   # Environment variables (local)
-├── .env.example           # Environment variables template
-└── README.md              # This file
-```
-
-## Configuration
-
-Configuration is loaded from:
-1. Environment variables (`.env` file)
-2. Azure App Configuration (if available)
-
-### Environment Variables
-
-```bash
-# Azure App Configuration
-AZURE_APP_CONFIG_ENDPOINT=https://your-app-config-resource.azconfig.io
-APP_CONFIG_KEY_FILTERS=contentflow.worker.*
-
-# Worker Settings
-WORKER_NAME=contentflow-worker
-NUM_PROCESSING_WORKERS=2
-NUM_SOURCE_WORKERS=2
-
-# Azure Storage Queue
-STORAGE_ACCOUNT_WORKER_QUEUE_URL=https://your-storage-account.queue.core.windows.net
-STORAGE_WORKER_QUEUE_NAME=contentflow-execution-requests
-
-# Queue Polling Settings
-QUEUE_POLL_INTERVAL_SECONDS=5
-QUEUE_VISIBILITY_TIMEOUT_SECONDS=300
-QUEUE_MAX_MESSAGES=32
-
-# Processing Settings
-MAX_TASK_RETRIES=3
-TASK_TIMEOUT_SECONDS=600
-
-# Cosmos DB
-COSMOS_DB_ENDPOINT=https://your-cosmos.documents.azure.com:443/
-COSMOS_DB_NAME=contentflow
-COSMOS_DB_CONTAINER_PIPELINES=pipelines
-COSMOS_DB_CONTAINER_VAULT_EXECUTIONS=vault_executions
-COSMOS_DB_CONTAINER_VAULTS=vaults
-COSMOS_DB_CONTAINER_LOCKS=vault_exec_locks
-COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS=vault_crawl_checkpoints
-
-# Azure Blob Storage
-BLOB_STORAGE_ACCOUNT_NAME=your-storage-account
-BLOB_STORAGE_CONTAINER_NAME=content
-
-# Source Worker Settings
-DEFAULT_POLLING_INTERVAL_SECONDS=300    # Default 5 minutes if executor doesn't specify
-SCHEDULER_SLEEP_INTERVAL_SECONDS=5      # How often scheduler checks for ready pipelines
-LOCK_TTL_SECONDS=300                    # Distributed lock TTL (5 minutes)
-
-# API Settings
-API_ENABLED=true
-API_HOST=0.0.0.0
-API_PORT=8099
-
-# Logging
-LOG_LEVEL=DEBUG
-DEBUG=true
-```
-
-**Per-Executor Polling Intervals**: Configure polling intervals directly in executor settings:
-```yaml
-executors:
-  - id: blob_input
-    type: azure_blob_input
-    settings:
-      polling_interval_seconds: 300  # Check every 5 minutes
-      blob_storage_account: "mystorageaccount"
-```
-
-See `.env.example` for complete configuration options.
-
-## Installation
-
-1. Install dependencies:
-```bash
-pip install -r requirements.txt
-```
-
-2. Configure environment:
-```bash
-cp .env.example .env
-# Edit .env with your configuration
-```
-
-3. Ensure contentflow-lib is available:
-```bash
-# Worker expects contentflow-lib in parent directory
-# ../contentflow-lib
-```
-
-## Usage
-
-### Running the Worker
-
-```bash
-python main.py
-```
-
-The worker will:
-1. Start configured number of processing and source workers
-2. Start the FastAPI health and status monitoring service
-3. Connect to Azure Storage Queue
-4. Begin processing tasks
-5. Monitor worker health and restart failed workers
-6. Handle graceful shutdown on SIGINT/SIGTERM
-
-### API Endpoints
-
-When `API_ENABLED=true`, the following health and status endpoints are available:
-
-- **Health Check**: `GET /health` - Returns worker health status
-- **Worker Status**: `GET /status` - Returns detailed worker process status
-- **Metrics**: `GET /metrics` - Returns worker performance metrics
-
-Example health check:
-```bash
-curl http://localhost:8099/health
-```
-
-Response:
-```json
-{
-    "status": "healthy",
-    "timestamp": "2026-01-02T10:30:00Z",
-    "worker_name": "contentflow-worker"
-}
-```
-
-### Graceful Shutdown
-
-Press `Ctrl+C` or send SIGTERM to gracefully stop all workers:
-```bash
-kill -TERM <worker-pid>
-```
-
-## Task Types
-
-### ContentProcessingTask
-Executes a pipeline on a content item.
-
-```python
-{
-    "task_id": "task_abc123",
-    "task_type": "content_processing",
-    "pipeline_id": "pipeline_xyz",
-    "pipeline_name": "Document Processing",
-    "execution_id": "exec_123",
-    "content_id": "content_456",
-    "content_data": {...},
-    "executed_input_executor": "blob_input",  # Already-executed input executor
-    "priority": "normal",
-    "max_retries": 3
-}
-```
-
-## Workflow
-
-### Source Worker Workflow (Continuous Scheduling)
-1. **Continuous Scheduling Loop**:
-   - Runs continuously, checking pipeline schedule every 5 seconds (configurable via `SCHEDULER_SLEEP_INTERVAL_SECONDS`)
-   - Maintains next execution time for each pipeline based on per-executor polling intervals
-   
-2. **Pipeline Discovery**:
-   - Queries Cosmos DB for enabled pipelines with associated vaults
-   - Extracts `polling_interval_seconds` from input executor settings (default: 300s)
-   - Schedules pipelines for execution at appropriate intervals
-   
-3. **Distributed Locking**:
-   - Before executing a pipeline, attempts to acquire a distributed lock in Cosmos DB
-   - Prevents multiple workers from processing the same pipeline simultaneously
-   - Locks auto-expire after 5 minutes (configurable via `LOCK_TTL_SECONDS`)
-   
-4. **Content Discovery**:
-   - Parse pipeline YAML to find input executor
-   - Execute input executor to discover content
-   - Create ContentProcessingTask for each discovered content item
-   - Mark the input executor as already executed (`executed_input_executor` field)
-   - Send tasks to queue
-   
-5. **Schedule Update**:
-   - After successful execution, update next execution time
-   - Release distributed lock
-   - Pipeline will execute again after polling interval expires
-
-**Example: Pipeline with 1-hour polling**
-```yaml
-executors:
-  - id: blob_input
-    type: azure_blob_input
-    settings:
-      polling_interval_seconds: 3600  # Check every hour
-      blob_storage_account: "mystorageaccount"
-      blob_container_name: "documents"
-```
-
-### Processing Worker Workflow
-1. Poll queue for ContentProcessingTask messages
-2. For each task:
-   - Load pipeline configuration
-   - Exclude the already-executed input executor
-   - Execute remaining pipeline on content
-   - Update execution status
-   - Delete message on success
-
-## Sending Tasks to the Queue
-
-You can send tasks from the API or other services:
-
-```python
-from contentflow_worker import TaskQueueClient, ContentProcessingTask
-
-# Initialize queue client
-queue_client = TaskQueueClient(
-    queue_url="https://your-storage.queue.core.windows.net",
-    queue_name="contentflow-execution-requests"
-)
-
-# Create task
-task = ContentProcessingTask(
-    task_id="task_123",
-    pipeline_id="pipeline_xyz",
-    pipeline_name="My Pipeline",
-    execution_id="exec_456",
-    content_id="content_789",
-    content_data={"text": "Sample content"}
-)
-
-# Send to queue
-queue_client.send_content_processing_task(task)
-```
-
-## Monitoring
-
-### Worker Status via API
-
-When the API is enabled, you can monitor worker status via HTTP:
-
-```bash
-# Check health
-curl http://localhost:8099/health
-
-# Get detailed status
-curl http://localhost:8099/status
-```
-
-### Worker Status Programmatically
-
-The engine provides status information:
-```python
-from contentflow_worker import WorkerEngine
-
-engine = WorkerEngine()
-status = engine.get_status()
-print(status)
-```
-
-Output:
-```json
-{
-    "running": true,
-    "processing_workers": {
-        "configured": 2,
-        "active": 2,
-        "workers": [
-            {"id": 0, "pid": 12345, "alive": true},
-            {"id": 1, "pid": 12346, "alive": true}
-        ]
-    },
-    "source_workers": {
-        "configured": 2,
-        "active": 2,
-        "workers": [
-            {"id": 0, "pid": 12347, "alive": true},
-            {"id": 1, "pid": 12348, "alive": true}
-        ]
-    }
-}
-```
-
-### Logs
-
-Workers log to:
-- Console (stdout)
-- File (configured via LOG_LEVEL)
-
-## Features
-
-✅ Multi-processing parallelism  
-✅ Azure Storage Queue integration  
-✅ Automatic worker restart on failure  
-✅ Task retry handling  
-✅ Graceful shutdown  
-✅ Configurable worker counts  
-✅ Pipeline execution tracking  
-✅ Content source discovery  
-✅ Cosmos DB integration  
-
-## Error Handling
-
-- **Task Failures**: Tasks are retried up to `max_retries` times
-- **Worker Crashes**: Engine automatically restarts crashed workers
-- **Queue Visibility**: Failed tasks become visible again after timeout
-- **Execution Tracking**: All execution status updates are recorded in Cosmos DB
-
-## Performance Tuning
-
-Adjust these settings for your workload:
-
-```bash
-# More workers = higher throughput
-NUM_PROCESSING_WORKERS=4
-NUM_SOURCE_WORKERS=2
-
-# Faster polling = lower latency
-QUEUE_POLL_INTERVAL_SECONDS=2
-
-# More messages per poll = higher throughput
-QUEUE_MAX_MESSAGES=32
-
-# Longer timeout = support longer-running pipelines
-TASK_TIMEOUT_SECONDS=1200
-
-# Queue visibility timeout for retries
-QUEUE_VISIBILITY_TIMEOUT_SECONDS=300
-```
-
-### Tuning Guidelines
-
-- **Throughput**: Increase `NUM_PROCESSING_WORKERS` and `QUEUE_MAX_MESSAGES`
-- **Latency**: Decrease `QUEUE_POLL_INTERVAL_SECONDS` and `SCHEDULER_SLEEP_INTERVAL_SECONDS`
-- **Memory**: Reduce worker counts to limit concurrent task processing
-- **Reliability**: Increase `MAX_TASK_RETRIES` and `TASK_TIMEOUT_SECONDS` for complex pipelines
-
-## Requirements
-
-- Python 3.12+
-- Azure Storage Account (Queue)
-- Azure Cosmos DB
-- contentflow-lib package
-- Azure credentials (DefaultAzureCredential)
diff --git a/contentflow-worker/__init__.py b/contentflow-worker/__init__.py
deleted file mode 100644
index 2a60444..0000000
--- a/contentflow-worker/__init__.py
+++ /dev/null
@@ -1,28 +0,0 @@
-"""
-ContentFlow Worker - Multi-processing content processing engine.
-"""
-
-# from .engine import WorkerEngine
-# from .models import (
-#     ContentProcessingTask,
-#     InputSourceTask,
-#     TaskType,
-#     TaskPriority,
-#     TaskStatus,
-# )
-# from .settings import WorkerSettings, get_settings
-# from .queue_client import TaskQueueClient
-
-# __version__ = "0.1.0"
-
-# __all__ = [
-#     "WorkerEngine",
-#     "ContentProcessingTask",
-#     "InputSourceTask",
-#     "TaskType",
-#     "TaskPriority",
-#     "TaskStatus",
-#     "WorkerSettings",
-#     "get_settings",
-#     "TaskQueueClient",
-# ]
diff --git a/contentflow-worker/app/__init__.py b/contentflow-worker/app/__init__.py
deleted file mode 100644
index e69de29..0000000
diff --git a/contentflow-worker/app/api.py b/contentflow-worker/app/api.py
deleted file mode 100644
index 83ae650..0000000
--- a/contentflow-worker/app/api.py
+++ /dev/null
@@ -1,130 +0,0 @@
-"""
-FastAPI application for worker health and status monitoring.
-
-This module provides HTTP endpoints for monitoring the health and status
-of the ContentFlow worker engine.
-"""
-import logging
-from datetime import datetime, timezone
-from typing import Optional
-from contextlib import asynccontextmanager
-
-from fastapi import FastAPI, status
-from fastapi.responses import JSONResponse
-from pydantic import BaseModel
-
-from app.settings import WorkerSettings
-from app.engine import WorkerEngine
-
-logger = logging.getLogger("contentflow.worker.api")
-
-class HealthResponse(BaseModel):
-    """Health check response model"""
-    status: str
-    timestamp: str
-    worker_name: str
-
-
-class WorkerStatusResponse(BaseModel):
-    """Worker status response model"""
-    worker_name: str
-    running: bool
-    timestamp: str
-    processing_workers: dict
-    source_workers: dict
-
-def create_app(settings: WorkerSettings, engine: Optional[WorkerEngine] = None) -> FastAPI:
-    """
-    Create and configure the FastAPI application.
-    
-    Args:
-        settings: Worker configuration
-        engine: Reference to the WorkerEngine instance
-        
-    Returns:
-        Configured FastAPI application
-    """
-    @asynccontextmanager
-    async def lifespan(app: FastAPI):
-        # Load the ML model into app.state during startup
-        app.state.engine = engine
-        app.state.settings = settings
-        app.state.start_time = datetime.now(timezone.utc)
-        yield
-        # Clean up (optional) during shutdown
-        app.state.engine = None
-        app.state.settings = None
-        app.state.start_time = None
-    
-    app = FastAPI(
-        title="ContentFlow Worker API",
-        description="Health and status monitoring API for ContentFlow worker service",
-        version="1.0.0",
-        lifespan=lifespan
-    )
-    
-    @app.get("/", tags=["root"])
-    async def root():
-        """Root endpoint"""
-        return {
-            "service": "ContentFlow Worker API",
-            "version": "1.0.0",
-            "worker_name": app.state.settings.WORKER_NAME
-        }
-    
-    @app.get("/health", response_model=HealthResponse, tags=["monitoring"])
-    async def health():
-        """
-        Health check endpoint.
-        
-        Returns basic health status indicating the API is responsive.
-        """
-        return HealthResponse(
-            status="healthy",
-            timestamp=datetime.now(timezone.utc).isoformat(),
-            worker_name=app.state.settings.WORKER_NAME
-        )
-    
-    @app.get("/status", response_model=WorkerStatusResponse, tags=["monitoring"])
-    async def get_status():
-        """
-        Get detailed worker status.
-        
-        Returns comprehensive status information about the worker engine
-        and all worker processes.
-        """
-        
-        engine = app.state.engine
-        engine_status = None
-        
-        if engine is None:
-            return JSONResponse(
-                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-                content={
-                    "error": "Worker engine not initialized",
-                    "timestamp": datetime.now(timezone.utc).isoformat()
-                }
-            )
-        
-        if isinstance(engine, WorkerEngine):
-            engine_status = engine.get_status()
-        
-        if not engine_status:
-            return JSONResponse(
-                status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-                content={
-                    "error": "Unable to retrieve worker status",
-                    "timestamp": datetime.now(timezone.utc).isoformat()
-                }
-            )
-        
-        return WorkerStatusResponse(
-            worker_name=app.state.settings.WORKER_NAME,
-            running=engine_status["running"],
-            timestamp=datetime.now(timezone.utc).isoformat(),
-            processing_workers=engine_status["processing_workers"],
-            source_workers=engine_status["source_workers"]
-        )
-        
-    return app
-    
\ No newline at end of file
diff --git a/contentflow-worker/app/engine.py b/contentflow-worker/app/engine.py
deleted file mode 100644
index 5f4b13f..0000000
--- a/contentflow-worker/app/engine.py
+++ /dev/null
@@ -1,237 +0,0 @@
-"""
-Worker engine for ContentFlow multi-processing content processing.
-
-This module implements the main WorkerEngine that manages:
-- Content processing workers
-- Input source loading workers
-- Worker lifecycle and graceful shutdown
-"""
-import logging
-import multiprocessing as mp
-import signal
-import sys
-import time
-from typing import List
-
-from app.worker.processing_worker import ContentProcessingWorker
-from app.worker.source_worker import InputSourceWorker
-from app.settings import WorkerSettings, get_settings
-
-logger = logging.getLogger("contentflow.worker.engine")
-
-
-class WorkerEngine:
-    """
-    Main engine for managing worker processes.
-    
-    The engine creates and manages two types of workers:
-    1. Content Processing Workers: Execute pipelines on content
-    2. Input Source Workers: Discover content and create processing tasks
-    
-    Features:
-    - Multi-processing based parallelism
-    - Graceful shutdown handling
-    - Worker health monitoring
-    - Automatic worker restart on failure
-    """
-    
-    def __init__(self, settings: WorkerSettings = None):
-        """
-        Initialize the worker engine.
-        
-        Args:
-            settings: Worker configuration (uses default if not provided)
-        """
-        self.settings = settings or get_settings()
-        self.processing_workers: List[mp.Process] = []
-        self.source_workers: List[mp.Process] = []
-        self.stop_event = mp.Event()
-        self.running = False
-        
-        logger.info(f"Initialized WorkerEngine: {self.settings.WORKER_NAME}")
-        logger.info(f"  Processing Workers: {self.settings.NUM_PROCESSING_WORKERS}")
-        logger.info(f"  Source Workers: {self.settings.NUM_SOURCE_WORKERS}")
-    
-    def start(self):
-        """Start all worker processes"""
-        if self.running:
-            logger.warning("WorkerEngine is already running")
-            return
-        
-        logger.info("Starting WorkerEngine...")
-        
-        # Setup signal handlers
-        signal.signal(signal.SIGINT, self._signal_handler)
-        signal.signal(signal.SIGTERM, self._signal_handler)
-        
-        # Start processing workers
-        logger.info(f"Starting {self.settings.NUM_PROCESSING_WORKERS} processing workers...")
-        for i in range(self.settings.NUM_PROCESSING_WORKERS):
-            worker = self._create_processing_worker(i)
-            worker.start()
-            self.processing_workers.append(worker)
-            logger.info(f"Started processing worker {i} (PID: {worker.pid})")
-        
-        # Start source workers
-        logger.info(f"Starting {self.settings.NUM_SOURCE_WORKERS} source workers...")
-        for i in range(self.settings.NUM_SOURCE_WORKERS):
-            worker = self._create_source_worker(i)
-            worker.start()
-            self.source_workers.append(worker)
-            logger.info(f"Started source worker {i} (PID: {worker.pid})")
-        
-        self.running = True
-        logger.info("WorkerEngine started successfully")
-    
-    def _create_processing_worker(self, worker_id: int) -> mp.Process:
-        """Create a content processing worker process"""
-        worker = ContentProcessingWorker(
-            worker_id=worker_id,
-            settings=self.settings,
-            stop_event=self.stop_event
-        )
-        
-        process = mp.Process(
-            target=worker.run,
-            name=f"ProcessingWorker-{worker_id}"
-        )
-        process.daemon = False  # Allow graceful shutdown
-        
-        return process
-    
-    def _create_source_worker(self, worker_id: int) -> mp.Process:
-        """Create an input source worker process"""
-        worker = InputSourceWorker(
-            worker_id=worker_id,
-            settings=self.settings,
-            stop_event=self.stop_event
-        )
-        
-        process = mp.Process(
-            target=worker.run,
-            name=f"SourceWorker-{worker_id}"
-        )
-        process.daemon = False  # Allow graceful shutdown
-        
-        return process
-    
-    def stop(self):
-        """Stop all worker processes gracefully"""
-        if not self.running:
-            logger.warning("WorkerEngine is not running")
-            return
-        
-        logger.info("Stopping WorkerEngine...")
-        
-        # Signal all workers to stop
-        self.stop_event.set()
-        
-        # Wait for processing workers to finish
-        logger.info("Waiting for processing workers to stop...")
-        for worker in self.processing_workers:
-            worker.join(timeout=30)
-            if worker.is_alive():
-                logger.warning(f"Worker {worker.name} did not stop gracefully, terminating...")
-                worker.terminate()
-                worker.join(timeout=5)
-                if worker.is_alive():
-                    logger.error(f"Worker {worker.name} could not be terminated")
-        
-        # Wait for source workers to finish
-        logger.info("Waiting for source workers to stop...")
-        for worker in self.source_workers:
-            worker.join(timeout=30)
-            if worker.is_alive():
-                logger.warning(f"Worker {worker.name} did not stop gracefully, terminating...")
-                worker.terminate()
-                worker.join(timeout=5)
-                if worker.is_alive():
-                    logger.error(f"Worker {worker.name} could not be terminated")
-        
-        self.running = False
-        logger.info("WorkerEngine stopped")
-    
-    def run(self):
-        """
-        Run the engine (blocking).
-        
-        This method starts all workers and monitors their health
-        until a shutdown signal is received.
-        """
-        self.start()
-        
-        try:
-            # Main monitoring loop
-            logger.info("Monitoring workers... (Press Ctrl+C to stop)")
-            
-            while not self.stop_event.is_set():
-                # Check worker health
-                self._check_worker_health()
-                
-                # Sleep between health checks
-                time.sleep(30)
-                
-        except KeyboardInterrupt:
-            logger.info("Received interrupt signal")
-        finally:
-            self.stop()
-    
-    def _check_worker_health(self):
-        """Check health of all workers and restart if needed"""
-        # Check processing workers
-        for i, worker in enumerate(self.processing_workers):
-            if not worker.is_alive() and not self.stop_event.is_set():
-                logger.warning(f"Processing worker {i} died, restarting...")
-                new_worker = self._create_processing_worker(i)
-                new_worker.start()
-                self.processing_workers[i] = new_worker
-                logger.info(f"Restarted processing worker {i} (PID: {new_worker.pid})")
-        
-        # Check source workers
-        for i, worker in enumerate(self.source_workers):
-            if not worker.is_alive() and not self.stop_event.is_set():
-                logger.warning(f"Source worker {i} died, restarting...")
-                new_worker = self._create_source_worker(i)
-                new_worker.start()
-                self.source_workers[i] = new_worker
-                logger.info(f"Restarted source worker {i} (PID: {new_worker.pid})")
-    
-    def _signal_handler(self, signum, frame):
-        """Handle shutdown signals"""
-        logger.info(f"WorkerEngine received signal {signum}")
-        self.stop_event.set()
-    
-    def get_status(self) -> dict:
-        """
-        Get current engine status.
-        
-        Returns:
-            Dictionary with engine status information
-        """
-        return {
-            "running": self.running,
-            "processing_workers": {
-                "configured": self.settings.NUM_PROCESSING_WORKERS,
-                "active": sum(1 for w in self.processing_workers if w.is_alive()),
-                "workers": [
-                    {
-                        "id": i,
-                        "pid": w.pid,
-                        "alive": w.is_alive()
-                    }
-                    for i, w in enumerate(self.processing_workers)
-                ]
-            },
-            "source_workers": {
-                "configured": self.settings.NUM_SOURCE_WORKERS,
-                "active": sum(1 for w in self.source_workers if w.is_alive()),
-                "workers": [
-                    {
-                        "id": i,
-                        "pid": w.pid,
-                        "alive": w.is_alive()
-                    }
-                    for i, w in enumerate(self.source_workers)
-                ]
-            }
-        }
diff --git a/contentflow-worker/app/models.py b/contentflow-worker/app/models.py
deleted file mode 100644
index ff29896..0000000
--- a/contentflow-worker/app/models.py
+++ /dev/null
@@ -1,111 +0,0 @@
-"""
-Task models for the ContentFlow worker engine.
-
-This module defines the data structures for processing tasks that are
-queued and processed by worker processes.
-"""
-from datetime import datetime, timezone
-from typing import Any, Dict, List, Optional
-from enum import Enum
-from pydantic import BaseModel, Field
-
-from contentflow.models import Content
-
-
-class TaskType(str, Enum):
-    """Type of task to be processed"""
-    CONTENT_PROCESSING = "content_processing"
-    INPUT_SOURCE_LOADING = "input_source_loading"
-
-
-class TaskPriority(str, Enum):
-    """Priority levels for task processing"""
-    LOW = "low"
-    NORMAL = "normal"
-    HIGH = "high"
-    CRITICAL = "critical"
-
-
-class TaskStatus(str, Enum):
-    """Status of task processing"""
-    QUEUED = "queued"
-    PROCESSING = "processing"
-    COMPLETED = "completed"
-    FAILED = "failed"
-    RETRYING = "retrying"
-
-
-class ContentProcessingTask(BaseModel):
-    """
-    Task for processing a content item through a pipeline.
-    
-    This task is created by input source workers and consumed by
-    content processing workers.
-    """
-    task_id: str = Field(description="Unique identifier for this task")
-    task_type: TaskType = TaskType.CONTENT_PROCESSING
-    priority: TaskPriority = TaskPriority.NORMAL
-    
-    # Pipeline execution details
-    pipeline_id: str = Field(description="ID of the pipeline to execute")
-    pipeline_name: str = Field(description="Name of the pipeline")
-    execution_id: str = Field(description="ID of the pipeline execution")
-    vault_id: Optional[str] = Field(default=None, description="ID of the vault associated with this content")
-    
-    # Input content details
-    content: List[Content] = Field(description="List of content items to process")
-
-    # Executor tracking
-    executed_input_executor: Optional[str] = Field(default=None, description="ID of input executor already executed")
-    
-    # Metadata
-    created_at: str = Field(default_factory=lambda: datetime.now(timezone.utc).isoformat())
-    retry_count: int = Field(default=0, description="Number of retry attempts")
-    max_retries: int = Field(default=3, description="Maximum number of retries")
-    
-    class Config:
-        use_enum_values = True
-
-
-class InputSourceTask(BaseModel):
-    """
-    Task for loading content from an input source.
-    
-    This task instructs an input source worker to scan a source
-    (e.g., Azure Blob Storage) and create content processing tasks.
-    """
-    task_id: str = Field(description="Unique identifier for this task")
-    task_type: TaskType = TaskType.INPUT_SOURCE_LOADING
-    priority: TaskPriority = TaskPriority.NORMAL
-    
-    # Source configuration
-    source_type: str = Field(description="Type of input source (e.g., azure_blob, azure_files)")
-    source_name: str = Field(description="Name/identifier of the source")
-    source_config: Dict[str, Any] = Field(description="Configuration for the source")
-    
-    # Pipeline to execute on discovered content
-    pipeline_id: str = Field(description="ID of the pipeline to execute for each content item")
-    pipeline_name: str = Field(description="Name of the pipeline")
-    
-    # Filtering options
-    filters: Optional[Dict[str, Any]] = Field(default=None, description="Filters for content discovery")
-    
-    # Metadata
-    created_at: str = Field(default_factory=lambda: datetime.now(timezone.utc).isoformat())
-    
-    class Config:
-        use_enum_values = True
-
-
-class TaskMessage(BaseModel):
-    """
-    Generic task message envelope for queue messages.
-    
-    This wrapper allows us to handle different task types
-    with a single queue structure.
-    """
-    task_type: TaskType
-    payload: Dict[str, Any] = Field(description="Task payload (serialized task)")
-    
-    class Config:
-        use_enum_values = True
diff --git a/contentflow-worker/app/queue_client.py b/contentflow-worker/app/queue_client.py
deleted file mode 100644
index 6b9b0f9..0000000
--- a/contentflow-worker/app/queue_client.py
+++ /dev/null
@@ -1,236 +0,0 @@
-"""
-Queue client for managing task messages in Azure Storage Queue.
-
-This module provides a wrapper around Azure Storage Queue for sending
-and receiving processing tasks.
-"""
-import json
-import logging
-from typing import Optional, List
-from azure.storage.queue import QueueClient, QueueMessage
-from azure.identity import ChainedTokenCredential
-from azure.core.exceptions import ResourceNotFoundError
-
-from contentflow.utils import get_azure_credential, make_safe_json
-
-from app.models import TaskMessage, ContentProcessingTask, InputSourceTask, TaskType
-
-logger = logging.getLogger("contentflow.worker.queue_client")
-
-
-class TaskQueueClient:
-    """
-    Client for managing task messages in Azure Storage Queue.
-    
-    This client provides methods to:
-    - Send tasks to the queue
-    - Receive tasks from the queue
-    - Delete processed messages
-    - Update message visibility
-    """
-    
-    def __init__(
-        self,
-        queue_url: str,
-        queue_name: str,
-        credential: Optional[ChainedTokenCredential] = None
-    ):
-        """
-        Initialize the task queue client.
-        
-        Args:
-            queue_url: Azure Storage account queue URL
-            queue_name: Name of the queue
-            credential: Azure credential (uses DefaultAzureCredential if not provided)
-        """
-        self.queue_url = queue_url
-        self.queue_name = queue_name
-        self.credential = credential or get_azure_credential()
-        
-        # Create queue client
-        full_queue_url = f"{queue_url}/{queue_name}"
-        self.client = QueueClient.from_queue_url(
-            queue_url=full_queue_url,
-            credential=self.credential
-        )
-        
-        logger.info(f"Initialized TaskQueueClient for queue: {queue_name}")
-    
-    async def ensure_queue_exists(self):
-        """Ensure the queue exists, create if it doesn't"""
-        try:
-            # Check if queue exists
-            properties = self.client.get_queue_properties()
-            logger.info(f"Queue '{self.queue_name}' exists with {properties.approximate_message_count} messages")
-        except ResourceNotFoundError:
-            # Create queue if it doesn't exist
-            logger.info(f"Creating queue: {self.queue_name}")
-            self.client.create_queue()
-    
-    def send_content_processing_task(
-        self,
-        task: ContentProcessingTask,
-        visibility_timeout: Optional[int] = None
-    ) -> str:
-        """
-        Send a content processing task to the queue.
-        
-        Args:
-            task: ContentProcessingTask to send
-            visibility_timeout: Optional visibility timeout in seconds
-            
-        Returns:
-            Message ID
-        """
-        message = TaskMessage(
-            task_type=TaskType.CONTENT_PROCESSING,
-            payload=make_safe_json(task.model_dump())
-        )
-        return self._send_message(message, visibility_timeout)
-    
-    def send_input_source_task(
-        self,
-        task: InputSourceTask,
-        visibility_timeout: Optional[int] = None
-    ) -> str:
-        """
-        Send an input source loading task to the queue.
-        
-        Args:
-            task: InputSourceTask to send
-            visibility_timeout: Optional visibility timeout in seconds
-            
-        Returns:
-            Message ID
-        """
-        message = TaskMessage(
-            task_type=TaskType.INPUT_SOURCE_LOADING,
-            payload=task.model_dump()
-        )
-        return self._send_message(message, visibility_timeout)
-    
-    def _send_message(
-        self,
-        message: TaskMessage,
-        visibility_timeout: Optional[int] = None
-    ) -> str:
-        """
-        Send a message to the queue.
-        
-        Args:
-            message: TaskMessage to send
-            visibility_timeout: Optional visibility timeout in seconds
-            
-        Returns:
-            Message ID
-        """
-        message_text = json.dumps(message.model_dump())
-        
-        result = self.client.send_message(
-            content=message_text,
-            visibility_timeout=visibility_timeout
-        )
-        
-        logger.debug(f"Sent message to queue: {result.id}")
-        return result.id
-    
-    def receive_messages(
-        self,
-        max_messages: int = 1,
-        visibility_timeout: int = 300
-    ) -> List[QueueMessage]:
-        """
-        Receive messages from the queue.
-        
-        Args:
-            max_messages: Maximum number of messages to receive
-            visibility_timeout: Visibility timeout in seconds
-            
-        Returns:
-            List of QueueMessage objects
-        """
-        messages = self.client.receive_messages(
-            max_messages=max_messages,
-            visibility_timeout=visibility_timeout
-        )
-        
-        return list(messages)
-    
-    def parse_message(self, message: QueueMessage) -> tuple[TaskType, dict]:
-        """
-        Parse a queue message into a task.
-        
-        Args:
-            message: QueueMessage from the queue
-            
-        Returns:
-            Tuple of (TaskType, task_payload_dict)
-        """
-        try:
-            # Parse message content
-            message_data = json.loads(message.content)
-            
-            # Extract task type and payload
-            task_type = TaskType(message_data["task_type"])
-            payload = message_data["payload"]
-            
-            return task_type, payload
-            
-        except Exception as e:
-            logger.error(f"Failed to parse message {message.id}: {e}")
-            raise
-    
-    def delete_message(self, message: QueueMessage):
-        """
-        Delete a message from the queue after successful processing.
-        
-        Args:
-            message: QueueMessage to delete
-        """
-        try:
-            self.client.delete_message(message.id, message.pop_receipt)
-            logger.debug(f"Deleted message: {message.id}")
-        except Exception as e:
-            logger.error(f"Failed to delete message {message.id}: {e}")
-            raise
-    
-    def update_message_visibility(
-        self,
-        message: QueueMessage,
-        visibility_timeout: int
-    ) -> QueueMessage:
-        """
-        Update message visibility timeout (e.g., to extend processing time).
-        
-        Args:
-            message: QueueMessage to update
-            visibility_timeout: New visibility timeout in seconds
-            
-        Returns:
-            Updated QueueMessage
-        """
-        try:
-            updated = self.client.update_message(
-                message.id,
-                message.pop_receipt,
-                visibility_timeout=visibility_timeout
-            )
-            logger.debug(f"Updated message visibility: {message.id}")
-            return updated
-        except Exception as e:
-            logger.error(f"Failed to update message visibility {message.id}: {e}")
-            raise
-    
-    def get_queue_length(self) -> int:
-        """
-        Get approximate number of messages in the queue.
-        
-        Returns:
-            Approximate message count
-        """
-        try:
-            properties = self.client.get_queue_properties()
-            return properties.approximate_message_count
-        except Exception as e:
-            logger.error(f"Failed to get queue properties: {e}")
-            return 0
diff --git a/contentflow-worker/app/settings.py b/contentflow-worker/app/settings.py
deleted file mode 100644
index d9474b9..0000000
--- a/contentflow-worker/app/settings.py
+++ /dev/null
@@ -1,176 +0,0 @@
-"""
-Worker settings and configuration for the ContentFlow worker engine.
-
-This module handles configuration loading from environment variables
-and Azure App Configuration.
-"""
-import os
-from typing import Optional
-from pydantic import BaseModel, Field
-from dotenv import load_dotenv, find_dotenv
-
-load_dotenv(find_dotenv('.env'))
-
-
-class WorkerSettings(BaseModel):
-    """Configuration settings for the worker engine"""
-    
-    AZURE_APP_CONFIG_ENDPOINT: Optional[str] = Field(default=None, description="Azure App Configuration endpoint URL")
-    APP_CONFIG_KEY_FILTERS: list = Field(default=["contentflow.worker.*"], description="Key filters for App Configuration")
-    
-    # Worker settings
-    WORKER_NAME: str = Field(default="contentflow-worker", description="Worker instance name")
-    NUM_PROCESSING_WORKERS: int = Field(default=0, description="Number of content processing worker processes")
-    NUM_SOURCE_WORKERS: int = Field(default=1, description="Number of input source loading worker processes")
-    
-    # Queue settings
-    STORAGE_ACCOUNT_WORKER_QUEUE_URL: str = Field(description="Azure Storage Queue URL")
-    STORAGE_WORKER_QUEUE_NAME: str = Field(default="contentflow-execution-requests", description="Queue name for processing tasks")
-    
-    # Polling settings
-    QUEUE_POLL_INTERVAL_SECONDS: int = Field(default=5, description="Interval between queue polls")
-    QUEUE_VISIBILITY_TIMEOUT_SECONDS: int = Field(default=300, description="Message visibility timeout (5 minutes)")
-    QUEUE_MAX_MESSAGES: int = Field(default=32, description="Maximum messages to retrieve per poll per worker")
-    DEFAULT_POLLING_INTERVAL_SECONDS: int = Field(default=300, description="Default polling interval if not specified in input executor (5 minutes)")
-    SCHEDULER_SLEEP_INTERVAL_SECONDS: int = Field(default=5, description="How often scheduler checks for ready pipelines")
-    LOCK_TTL_SECONDS: int = Field(default=300, description="Lock time-to-live (5 minutes)")
-    
-    # Processing settings
-    MAX_TASK_RETRIES: int = Field(default=3, description="Maximum retries for failed tasks")
-    TASK_TIMEOUT_SECONDS: int = Field(default=600, description="Timeout for task processing (10 minutes)")
-    
-    # Cosmos DB settings (for pipeline and execution tracking)
-    COSMOS_DB_ENDPOINT: str = Field(description="Cosmos DB endpoint")
-    COSMOS_DB_NAME: str = Field(default="contentflow", description="Cosmos DB database name")
-    COSMOS_DB_CONTAINER_PIPELINES: str = Field(default="pipelines", description="Container for pipelines")
-    COSMOS_DB_CONTAINER_VAULT_EXECUTIONS: str = Field(default="vault_executions", description="Container for executions")
-    COSMOS_DB_CONTAINER_VAULTS: str = Field(default="vaults", description="Container for vaults")
-    COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS: str = Field(default="vault_exec_locks", description="Container for distributed locks")
-    COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS: str = Field(default="vault_crawl_checkpoints", description="Container for vault input executor crawling checkpoints")
-    
-    # Blob Storage settings (for content retrieval)
-    BLOB_STORAGE_ACCOUNT_NAME: str = Field(description="Azure Blob Storage account name")
-    BLOB_STORAGE_CONTAINER_NAME: str = Field(default="content", description="Container for content")
-    
-    # API settings
-    API_ENABLED: bool = Field(default=True, description="Enable health/status API")
-    API_HOST: str = Field(default="0.0.0.0", description="API host to bind to")
-    API_PORT: int = Field(default=8099, description="API port to bind to")
-    
-    # Logging
-    LOG_LEVEL: str = Field(default="DEBUG", description="Logging level")
-    DEBUG: bool = Field(default=False, description="Debug mode")
-    
-    def __init__(self, **kwargs):
-        """Initialize WorkerSettings and load from environment/App Config"""
-        # Load from environment variables first
-        env_config = self._load_from_env()
-        merged_config = {**env_config, **kwargs}
-        super().__init__(**merged_config)
-        
-        # Try to load from Azure App Configuration
-        self._load_from_app_config()
-    
-    def _load_from_env(self) -> dict:
-        """Load configuration from environment variables"""
-        return {
-            "AZURE_APP_CONFIG_ENDPOINT": os.getenv("AZURE_APP_CONFIG_ENDPOINT", ""),
-            "APP_CONFIG_KEY_FILTERS": os.getenv("APP_CONFIG_KEY_FILTERS", "contentflow.worker.*").split(","),
-            "WORKER_NAME": os.getenv("WORKER_NAME", "contentflow-worker"),
-            "NUM_PROCESSING_WORKERS": int(os.getenv("NUM_PROCESSING_WORKERS", "0")),
-            "NUM_SOURCE_WORKERS": int(os.getenv("NUM_SOURCE_WORKERS", "1")),
-            "STORAGE_ACCOUNT_WORKER_QUEUE_URL": os.getenv("STORAGE_ACCOUNT_WORKER_QUEUE_URL", ""),
-            "STORAGE_WORKER_QUEUE_NAME": os.getenv("STORAGE_WORKER_QUEUE_NAME", "contentflow-execution-requests"),
-            "QUEUE_POLL_INTERVAL_SECONDS": int(os.getenv("QUEUE_POLL_INTERVAL_SECONDS", "5")),
-            "QUEUE_VISIBILITY_TIMEOUT_SECONDS": int(os.getenv("QUEUE_VISIBILITY_TIMEOUT_SECONDS", "300")),
-            "QUEUE_MAX_MESSAGES": int(os.getenv("QUEUE_MAX_MESSAGES", "32")),
-            "MAX_TASK_RETRIES": int(os.getenv("MAX_TASK_RETRIES", "3")),
-            "TASK_TIMEOUT_SECONDS": int(os.getenv("TASK_TIMEOUT_SECONDS", "600")),
-            "COSMOS_DB_ENDPOINT": os.getenv("COSMOS_DB_ENDPOINT", ""),
-            "COSMOS_DB_NAME": os.getenv("COSMOS_DB_NAME", "contentflow"),
-            "COSMOS_DB_CONTAINER_PIPELINES": os.getenv("COSMOS_DB_CONTAINER_PIPELINES", "pipelines"),
-            "COSMOS_DB_CONTAINER_VAULTS": os.getenv("COSMOS_DB_CONTAINER_VAULTS", "vaults"),
-            "COSMOS_DB_CONTAINER_VAULT_EXECUTIONS": os.getenv("COSMOS_DB_CONTAINER_VAULT_EXECUTIONS", "vault_executions"),
-            "COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS": os.getenv("COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS", "vault_exec_locks"),
-            "COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS": os.getenv("COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS", "vault_crawl_checkpoints"),
-            "DEFAULT_POLLING_INTERVAL_SECONDS": int(os.getenv("DEFAULT_POLLING_INTERVAL_SECONDS", "300")),
-            "SCHEDULER_SLEEP_INTERVAL_SECONDS": int(os.getenv("SCHEDULER_SLEEP_INTERVAL_SECONDS", "5")),
-            "LOCK_TTL_SECONDS": int(os.getenv("LOCK_TTL_SECONDS", "300")),
-            "BLOB_STORAGE_ACCOUNT_NAME": os.getenv("BLOB_STORAGE_ACCOUNT_NAME", ""),
-            "BLOB_STORAGE_CONTAINER_NAME": os.getenv("BLOB_STORAGE_CONTAINER_NAME", "content"),
-            "API_ENABLED": os.getenv("API_ENABLED", "True").lower() in ("true", "1", "yes"),
-            "API_HOST": os.getenv("API_HOST", "0.0.0.0"),
-            "API_PORT": int(os.getenv("API_PORT", "8099")),
-            "LOG_LEVEL": os.getenv("LOG_LEVEL", "DBEUG"),
-            "DEBUG": os.getenv("DEBUG", "False").lower() in ("true", "1", "yes"),
-        }
-    
-    def _load_from_app_config(self):
-        """Load configuration from Azure App Configuration (if available)"""
-        try:
-            if self.AZURE_APP_CONFIG_ENDPOINT in [None, ""]:
-                print("Azure App Configuration endpoint not set in env variable AZURE_APP_CONFIG_ENDPOINT, skipping App Config load.")
-                return
-            
-            from contentflow.utils import ConfigurationProvider
-            config_provider = ConfigurationProvider(app_config_endpoint=self.AZURE_APP_CONFIG_ENDPOINT, config_key_filters=self.APP_CONFIG_KEY_FILTERS)
-            
-            # List of settings to load from App Config
-            config_keys = [
-                "STORAGE_ACCOUNT_WORKER_QUEUE_URL",
-                "STORAGE_WORKER_QUEUE_NAME",
-                "COSMOS_DB_ENDPOINT",
-                "COSMOS_DB_NAME",
-                "BLOB_STORAGE_ACCOUNT_NAME",
-                "BLOB_STORAGE_CONTAINER_NAME",
-                "NUM_PROCESSING_WORKERS",
-                "NUM_SOURCE_WORKERS",
-                "LOG_LEVEL",
-                "DEBUG",
-                "API_ENABLED",
-                "API_HOST",
-                "API_PORT",
-                "QUEUE_POLL_INTERVAL_SECONDS",
-                "QUEUE_VISIBILITY_TIMEOUT_SECONDS",
-                "QUEUE_MAX_MESSAGES",
-                "MAX_TASK_RETRIES",
-                "TASK_TIMEOUT_SECONDS",
-                "DEFAULT_POLLING_INTERVAL_SECONDS",
-                "SCHEDULER_SLEEP_INTERVAL_SECONDS",
-                "LOCK_TTL_SECONDS"
-            ]
-            
-            for key in config_keys:
-                value = config_provider.get_config_value(key)
-                if value is not None:
-                    # Convert to appropriate type
-                    if key in ["NUM_PROCESSING_WORKERS", "NUM_SOURCE_WORKERS", "API_PORT", "QUEUE_POLL_INTERVAL_SECONDS", 
-                               "QUEUE_VISIBILITY_TIMEOUT_SECONDS", "QUEUE_MAX_MESSAGES", "MAX_TASK_RETRIES", "TASK_TIMEOUT_SECONDS", 
-                               "SOURCE_WORKER_POLL_INTERVAL_SECONDS", "DEFAULT_POLLING_INTERVAL_SECONDS", "SCHEDULER_SLEEP_INTERVAL_SECONDS", 
-                               "LOCK_TTL_SECONDS"]:
-                        value = int(value)
-                    elif key in ["API_ENABLED", "DEBUG"]:
-                        value = value.lower() in ("true", "1", "yes")
-                    
-                    setattr(self, key, value)
-                    
-        except ImportError:
-            # Config provider not available, use environment variables only
-            pass
-        except Exception as e:
-            print(f"Warning: Failed to load from App Configuration: {e}")
-    
-    class Config:
-        validate_assignment = True
-
-
-def get_settings() -> WorkerSettings:
-    """Get worker settings (singleton pattern)"""
-    global _settings
-    if _settings is None:
-        _settings = WorkerSettings()
-    return _settings
-
-
-# Global settings instance
-_settings: Optional[WorkerSettings] = None
diff --git a/contentflow-worker/app/startup.py b/contentflow-worker/app/startup.py
deleted file mode 100644
index b0cd9e0..0000000
--- a/contentflow-worker/app/startup.py
+++ /dev/null
@@ -1,225 +0,0 @@
-"""
-Startup validation and health checks for ContentFlow Worker.
-
-This module performs pre-flight checks before starting the worker engine:
-- Validates required settings
-- Verifies Cosmos DB connectivity and containers
-- Verifies Azure Storage Queue connectivity
-"""
-import logging
-from typing import List, Tuple
-
-from azure.cosmos import CosmosClient
-from azure.core.exceptions import ResourceNotFoundError, AzureError
-from azure.storage.queue import QueueClient
-
-from contentflow.utils import get_azure_credential
-from app.settings import WorkerSettings
-
-logger = logging.getLogger("contentflow.worker.startup")
-
-
-class StartupValidator:
-    """Validates system readiness before starting the worker engine"""
-    
-    def __init__(self, settings: WorkerSettings):
-        """
-        Initialize the startup validator.
-        
-        Args:
-            settings: Worker configuration settings
-        """
-        self.settings = settings
-        self.errors: List[str] = []
-        self.warnings: List[str] = []
-    
-    def validate_all(self) -> bool:
-        """
-        Run all startup validations.
-        
-        Returns:
-            True if all checks pass, False if any critical errors occur
-        """
-        logger.info("=" * 60)
-        logger.info("Running Startup Validation Checks")
-        logger.info("=" * 60)
-        
-        # Run all validation checks
-        checks = [
-            ("Settings Validation", self._validate_settings),
-            ("Cosmos DB Connectivity", self._validate_cosmos_connectivity),
-            ("Cosmos DB Containers", self._validate_cosmos_containers),
-            ("Storage Queue Connectivity", self._validate_queue_connectivity),
-        ]
-        
-        for check_name, check_func in checks:
-            logger.info(f"Checking: {check_name}...")
-            try:
-                success, message = check_func()
-                if success:
-                    logger.info(f"✅ {check_name}: {message}")
-                else:
-                    logger.error(f"❌ {check_name}: {message}")
-                    self.errors.append(f"{check_name}: {message}")
-            except Exception as e:
-                logger.error(f"❌ {check_name}: Unexpected error - {e}", exc_info=True)
-                self.errors.append(f"{check_name}: {str(e)}")
-        
-        # Display summary
-        logger.info("=" * 60)
-        if self.warnings:
-            logger.warning(f"⚠️  {len(self.warnings)} warning(s):")
-            for warning in self.warnings:
-                logger.warning(f"  - {warning}")
-        
-        if self.errors:
-            logger.error(f"❌ {len(self.errors)} critical error(s) found:")
-            for error in self.errors:
-                logger.error(f"  - {error}")
-            logger.error("=" * 60)
-            logger.error("Startup validation FAILED. Fix errors before starting.")
-            return False
-        else:
-            logger.info("✅ All startup validation checks passed!")
-            logger.info("=" * 60)
-            return True
-    
-    def _validate_settings(self) -> Tuple[bool, str]:
-        """Validate that all required settings are present"""
-        required_settings = {
-            "COSMOS_DB_ENDPOINT": self.settings.COSMOS_DB_ENDPOINT,
-            "COSMOS_DB_NAME": self.settings.COSMOS_DB_NAME,
-            "STORAGE_ACCOUNT_WORKER_QUEUE_URL": self.settings.STORAGE_ACCOUNT_WORKER_QUEUE_URL,
-            "STORAGE_WORKER_QUEUE_NAME": self.settings.STORAGE_WORKER_QUEUE_NAME,
-            "BLOB_STORAGE_ACCOUNT_NAME": self.settings.BLOB_STORAGE_ACCOUNT_NAME,
-        }
-        
-        missing = []
-        for key, value in required_settings.items():
-            if not value or value == "":
-                missing.append(key)
-        
-        if missing:
-            return False, f"Missing required settings: {', '.join(missing)}"
-        
-        # Validate worker counts
-        if self.settings.NUM_PROCESSING_WORKERS < 0:
-            return False, "NUM_PROCESSING_WORKERS must be >= 0"
-        
-        if self.settings.NUM_SOURCE_WORKERS < 0:
-            return False, "NUM_SOURCE_WORKERS must be >= 0"
-        
-        if self.settings.NUM_PROCESSING_WORKERS == 0 and self.settings.NUM_SOURCE_WORKERS == 0:
-            return False, "At least one of NUM_PROCESSING_WORKERS or NUM_SOURCE_WORKERS must be > 0"
-        
-        # Warnings for configuration
-        if self.settings.NUM_PROCESSING_WORKERS == 0:
-            self.warnings.append("NUM_PROCESSING_WORKERS is 0 - no content processing will occur")
-        
-        if self.settings.NUM_SOURCE_WORKERS == 0:
-            self.warnings.append("NUM_SOURCE_WORKERS is 0 - no source scanning will occur")
-        
-        return True, f"All required settings present (Processing Workers: {self.settings.NUM_PROCESSING_WORKERS}, Source Workers: {self.settings.NUM_SOURCE_WORKERS})"
-    
-    def _validate_cosmos_connectivity(self) -> Tuple[bool, str]:
-        """Validate connectivity to Cosmos DB"""
-        try:
-            credential = get_azure_credential()
-            cosmos_client = CosmosClient(
-                url=self.settings.COSMOS_DB_ENDPOINT,
-                credential=credential
-            )
-            
-            # Try to list databases to verify connectivity
-            databases = list(cosmos_client.list_databases())
-            
-            # Check if our database exists
-            db_exists = any(db["id"] == self.settings.COSMOS_DB_NAME for db in databases)
-            
-            if not db_exists:
-                return False, f"Database '{self.settings.COSMOS_DB_NAME}' not found in Cosmos DB"
-            
-            return True, f"Connected to Cosmos DB at {self.settings.COSMOS_DB_ENDPOINT}"
-            
-        except AzureError as e:
-            return False, f"Failed to connect to Cosmos DB: {str(e)}"
-        except Exception as e:
-            return False, f"Unexpected error connecting to Cosmos DB: {str(e)}"
-    
-    def _validate_cosmos_containers(self) -> Tuple[bool, str]:
-        """Validate that required Cosmos DB containers exist"""
-        required_containers = [
-            self.settings.COSMOS_DB_CONTAINER_PIPELINES,
-            self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS,
-            self.settings.COSMOS_DB_CONTAINER_VAULTS,
-            self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS,
-            self.settings.COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS,
-        ]
-        
-        try:
-            credential = get_azure_credential()
-            cosmos_client = CosmosClient(
-                url=self.settings.COSMOS_DB_ENDPOINT,
-                credential=credential
-            )
-            
-            database = cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            
-            # Check each container
-            existing_containers = list(database.list_containers())
-            existing_names = [c["id"] for c in existing_containers]
-            
-            missing_containers = []
-            for container_name in required_containers:
-                if container_name not in existing_names:
-                    missing_containers.append(container_name)
-            
-            if missing_containers:
-                return False, f"Missing required containers: {', '.join(missing_containers)}"
-            
-            return True, f"All {len(required_containers)} required containers exist"
-            
-        except ResourceNotFoundError:
-            return False, f"Database '{self.settings.COSMOS_DB_NAME}' not found"
-        except AzureError as e:
-            return False, f"Failed to access Cosmos DB containers: {str(e)}"
-        except Exception as e:
-            return False, f"Unexpected error checking containers: {str(e)}"
-    
-    def _validate_queue_connectivity(self) -> Tuple[bool, str]:
-        """Validate connectivity to Azure Storage Queue"""
-        try:
-            credential = get_azure_credential()
-            full_queue_url = f"{self.settings.STORAGE_ACCOUNT_WORKER_QUEUE_URL}/{self.settings.STORAGE_WORKER_QUEUE_NAME}"
-            
-            queue_client = QueueClient.from_queue_url(
-                queue_url=full_queue_url,
-                credential=credential
-            )
-            
-            # Try to get queue properties to verify connectivity and existence
-            properties = queue_client.get_queue_properties()
-            message_count = properties.approximate_message_count
-            
-            return True, f"Connected to queue '{self.settings.STORAGE_WORKER_QUEUE_NAME}' ({message_count} messages)"
-            
-        except ResourceNotFoundError:
-            return False, f"Queue '{self.settings.STORAGE_WORKER_QUEUE_NAME}' not found"
-        except AzureError as e:
-            return False, f"Failed to connect to Storage Queue: {str(e)}"
-        except Exception as e:
-            return False, f"Unexpected error connecting to queue: {str(e)}"
-
-
-def run_startup_checks(settings: WorkerSettings) -> bool:
-    """
-    Run startup validation checks.
-    
-    Args:
-        settings: Worker configuration settings
-        
-    Returns:
-        True if all checks pass, False otherwise
-    """
-    validator = StartupValidator(settings)
-    return validator.validate_all()
diff --git a/contentflow-worker/app/utils.py b/contentflow-worker/app/utils.py
deleted file mode 100644
index 3a85232..0000000
--- a/contentflow-worker/app/utils.py
+++ /dev/null
@@ -1,182 +0,0 @@
-"""
-Utility functions for the ContentFlow worker.
-"""
-import logging
-from typing import Dict, Any, Optional
-from datetime import datetime, timezone
-
-logger = logging.getLogger(__name__)
-
-
-def create_execution_id() -> str:
-    """Generate a unique execution ID"""
-    import uuid
-    return f"exec_{uuid.uuid4().hex[:12]}"
-
-
-def create_task_id() -> str:
-    """Generate a unique task ID"""
-    import uuid
-    return f"task_{uuid.uuid4().hex[:12]}"
-
-
-def get_timestamp() -> str:
-    """Get current timestamp in ISO format"""
-    return datetime.now(timezone.utc).isoformat()
-
-
-def format_duration(seconds: float) -> str:
-    """
-    Format duration in seconds to human-readable string.
-    
-    Args:
-        seconds: Duration in seconds
-        
-    Returns:
-        Formatted string (e.g., "2m 30s", "1h 15m 30s")
-    """
-    if seconds < 60:
-        return f"{seconds:.1f}s"
-    elif seconds < 3600:
-        minutes = int(seconds // 60)
-        secs = int(seconds % 60)
-        return f"{minutes}m {secs}s"
-    else:
-        hours = int(seconds // 3600)
-        minutes = int((seconds % 3600) // 60)
-        secs = int(seconds % 60)
-        return f"{hours}h {minutes}m {secs}s"
-
-
-def sanitize_config(config: Dict[str, Any]) -> Dict[str, Any]:
-    """
-    Sanitize configuration by removing sensitive values.
-    
-    Args:
-        config: Configuration dictionary
-        
-    Returns:
-        Sanitized configuration with sensitive values masked
-    """
-    sensitive_keys = [
-        'password', 'secret', 'key', 'token', 'credential',
-        'account_key', 'connection_string', 'api_key'
-    ]
-    
-    sanitized = {}
-    for k, v in config.items():
-        key_lower = k.lower()
-        if any(sensitive in key_lower for sensitive in sensitive_keys):
-            sanitized[k] = "***REDACTED***"
-        elif isinstance(v, dict):
-            sanitized[k] = sanitize_config(v)
-        else:
-            sanitized[k] = v
-    
-    return sanitized
-
-
-def validate_queue_config(
-    queue_url: str,
-    queue_name: str
-) -> bool:
-    """
-    Validate queue configuration.
-    
-    Args:
-        queue_url: Azure Storage Queue URL
-        queue_name: Queue name
-        
-    Returns:
-        True if valid, False otherwise
-    """
-    if not queue_url:
-        logger.error("Queue URL is required")
-        return False
-    
-    if not queue_name:
-        logger.error("Queue name is required")
-        return False
-    
-    if not queue_url.startswith("https://"):
-        logger.error("Queue URL must start with https://")
-        return False
-    
-    if ".queue.core.windows.net" not in queue_url:
-        logger.warning("Queue URL does not appear to be an Azure Storage Queue URL")
-    
-    return True
-
-
-def validate_cosmos_config(
-    endpoint: str,
-    database_name: str
-) -> bool:
-    """
-    Validate Cosmos DB configuration.
-    
-    Args:
-        endpoint: Cosmos DB endpoint URL
-        database_name: Database name
-        
-    Returns:
-        True if valid, False otherwise
-    """
-    if not endpoint:
-        logger.error("Cosmos DB endpoint is required")
-        return False
-    
-    if not database_name:
-        logger.error("Database name is required")
-        return False
-    
-    if not endpoint.startswith("https://"):
-        logger.error("Cosmos DB endpoint must start with https://")
-        return False
-    
-    if ".documents.azure.com" not in endpoint:
-        logger.warning("Endpoint does not appear to be a Cosmos DB URL")
-    
-    return True
-
-
-def retry_with_backoff(
-    func,
-    max_retries: int = 3,
-    base_delay: float = 1.0,
-    max_delay: float = 60.0
-):
-    """
-    Retry a function with exponential backoff.
-    
-    Args:
-        func: Function to retry
-        max_retries: Maximum number of retries
-        base_delay: Base delay in seconds
-        max_delay: Maximum delay in seconds
-        
-    Returns:
-        Function result if successful
-        
-    Raises:
-        Exception: Last exception if all retries fail
-    """
-    import time
-    
-    last_exception = None
-    delay = base_delay
-    
-    for attempt in range(max_retries + 1):
-        try:
-            return func()
-        except Exception as e:
-            last_exception = e
-            
-            if attempt < max_retries:
-                logger.warning(f"Attempt {attempt + 1} failed: {e}. Retrying in {delay}s...")
-                time.sleep(delay)
-                delay = min(delay * 2, max_delay)
-            else:
-                logger.error(f"All {max_retries} retries failed")
-    
-    raise last_exception
diff --git a/contentflow-worker/app/worker/__init__.py b/contentflow-worker/app/worker/__init__.py
deleted file mode 100644
index e69de29..0000000
diff --git a/contentflow-worker/app/worker/processing_worker.py b/contentflow-worker/app/worker/processing_worker.py
deleted file mode 100644
index c639de0..0000000
--- a/contentflow-worker/app/worker/processing_worker.py
+++ /dev/null
@@ -1,482 +0,0 @@
-"""
-Content processing worker for executing pipeline tasks.
-
-This module implements the ContentProcessingWorker that:
-- Listens to the task queue for content processing tasks
-- Executes pipelines on content
-- Reports execution status back to Cosmos DB
-"""
-
-import asyncio
-from datetime import datetime, timezone
-import logging
-import multiprocessing as mp
-import signal
-import sys
-import time
-import traceback
-from pathlib import Path
-from typing import List, Optional
-
-from azure.identity import ChainedTokenCredential
-from azure.cosmos import CosmosClient
-from azure.cosmos import exceptions as cosmos_exceptions
-
-from contentflow.pipeline import PipelineExecutor
-from contentflow.models import Content, ContentIdentifier
-from contentflow.pipeline import PipelineResult
-from contentflow.utils import get_azure_credential, make_safe_json
-
-from app.models import ContentProcessingTask
-from app.queue_client import TaskQueueClient
-from app.settings import WorkerSettings
-
-logger = logging.getLogger("contentflow.worker.processing_worker")
-
-
-class ContentProcessingWorker:
-    """
-    Worker process for executing content processing tasks.
-    
-    This worker:
-    1. Polls the task queue for ContentProcessingTask messages
-    2. Loads pipeline configuration from Cosmos DB
-    3. Executes the pipeline on the content
-    4. Updates execution status in Cosmos DB
-    5. Deletes the message from queue on success
-    """
-    
-    def __init__(
-        self,
-        worker_id: int,
-        settings: WorkerSettings,
-        stop_event
-    ):
-        """
-        Initialize the content processing worker.
-        
-        Args:
-            worker_id: Unique worker identifier
-            settings: Worker configuration settings
-            stop_event: Multiprocessing event for graceful shutdown
-        """
-        self.worker_id = worker_id
-        self.settings = settings
-        self.stop_event = stop_event
-        self.name = f"ContentProcessingWorker-{worker_id}"
-        
-        # Azure clients (initialized in run)
-        self.credential: Optional[ChainedTokenCredential] = None
-        self.queue_client: Optional[TaskQueueClient] = None
-        self.cosmos_client: Optional[CosmosClient] = None
-        
-        logger.info(f"Initialized {self.name}")
-    
-    def run(self):
-        """Main worker loop"""
-        logger.info(f"{self.name} starting...")
-        
-        # Setup signal handlers for graceful shutdown
-        signal.signal(signal.SIGINT, self._signal_handler)
-        signal.signal(signal.SIGTERM, self._signal_handler)
-        
-        try:
-            # Initialize Azure clients
-            self._initialize_clients()
-            
-            # Main processing loop
-            logger.info(f"{self.name} entering main processing loop")
-            
-            while not self.stop_event.is_set():
-                try:
-                    self._process_batch()
-                    
-                    # Sleep between polls
-                    if not self.stop_event.is_set():
-                        time.sleep(self.settings.QUEUE_POLL_INTERVAL_SECONDS)
-                        
-                except Exception as e:
-                    logger.error(f"{self.name} error in processing loop: {e}")
-                    logger.error(traceback.format_exc())
-                    time.sleep(5)  # Back off on error
-                    
-        except KeyboardInterrupt:
-            logger.info(f"{self.name} received interrupt signal")
-        except Exception as e:
-            logger.error(f"{self.name} fatal error: {e}")
-            logger.error(traceback.format_exc())
-        finally:
-            logger.info(f"{self.name} shutting down...")
-    
-    def _initialize_clients(self):
-        """Initialize Azure clients"""
-        logger.info(f"{self.name} initializing Azure clients...")
-        
-        # Initialize credential
-        self.credential = get_azure_credential()
-        
-        # Initialize queue client
-        self.queue_client = TaskQueueClient(
-            queue_url=self.settings.STORAGE_ACCOUNT_WORKER_QUEUE_URL,
-            queue_name=self.settings.STORAGE_WORKER_QUEUE_NAME,
-            credential=self.credential
-        )
-        
-        # Initialize Cosmos DB client
-        self.cosmos_client = CosmosClient(
-            url=self.settings.COSMOS_DB_ENDPOINT,
-            credential=self.credential
-        )
-        
-        logger.info(f"{self.name} clients initialized")
-    
-    def _process_batch(self):
-        """Process a batch of messages from the queue"""
-        try:
-            # Receive messages
-            logger.debug(f"{self.name} polling for messages... will retrieve up to {self.settings.QUEUE_MAX_MESSAGES} messages.")
-            
-            messages = self.queue_client.receive_messages(
-                max_messages=self.settings.QUEUE_MAX_MESSAGES,
-                visibility_timeout=self.settings.QUEUE_VISIBILITY_TIMEOUT_SECONDS
-            )
-            
-            if not messages:
-                logger.debug(f"{self.name} no messages in queue")
-                return
-            
-            logger.debug(f"{self.name} received {len(messages)} messages")
-            
-            # Process each message
-            for message in messages:
-                if self.stop_event.is_set():
-                    break
-                    
-                try:
-                    self._process_message(message)
-                except Exception as e:
-                    logger.error(f"{self.name} failed to process message {message.id}: {e}")
-                    logger.error(traceback.format_exc())
-                    # Message will become visible again after timeout
-                    
-        except Exception as e:
-            logger.error(f"{self.name} error receiving messages: {e}")
-            logger.error(traceback.format_exc())
-    
-    def _process_message(self, message):
-        """Process a single message"""
-        logger.debug(f"{self.name} processing message {message.id}")
-        
-        try:
-            # Parse message
-            task_type, payload = self.queue_client.parse_message(message)
-            logger.debug(f"{self.name} parsed message {message.id} with task type {task_type}")
-            
-            # Only process content processing tasks
-            if task_type.value != "content_processing":
-                logger.warning(f"{self.name} received non-processing task: {task_type}")
-                # self.queue_client.delete_message(message)
-                return
-            
-            # Create task object
-            task = ContentProcessingTask(**payload)
-            
-            # Check retry count
-            if task.retry_count >= task.max_retries:
-                logger.error(f"{self.name} task {task.task_id} exceeded max retries")
-                self._update_execution_status(execution_id=task.execution_id, 
-                                              status="failed", 
-                                              error="Max retries exceeded")
-                self.queue_client.delete_message(message)
-                return
-            
-            # Execute task
-            success = self._execute_task(task)
-            
-            # Delete message on success
-            if success:
-                self.queue_client.delete_message(message)
-                logger.debug(f"{self.name} completed message {message.id}")
-            else:
-                logger.warning(f"{self.name} task failed, will retry")
-                # Message will become visible again after timeout
-                
-        except Exception as e:
-            logger.error(f"{self.name} error processing message {message.id}: {e}")
-            logger.exception(e)
-            raise
-    
-    def _execute_task(self, task: ContentProcessingTask) -> bool:
-        """
-        Execute a content processing task.
-        
-        Args:
-            task: ContentProcessingTask to execute
-            
-        Returns:
-            True if successful (completed or failed), False if an exception occurred that was not handled
-        """
-        logger.debug(f"{self.name} executing task '{task.task_id}', with execution id '{task.execution_id}' for pipeline '{task.pipeline_name}'")
-        
-        try:
-            # Update execution status to running
-            self._update_execution_status(execution_id=task.execution_id, status="running")
-            
-            # Get pipeline from Cosmos DB
-            pipeline_config = self._get_pipeline(task.pipeline_id)
-            if not pipeline_config:
-                logger.error(f"{self.name} pipeline not found: {task.pipeline_id}")
-                self._update_execution_status(execution_id=task.execution_id, status="failed", error="Pipeline not found")
-                return True
-            
-            # verify input content
-            content = task.content
-            if not content or len(content) == 0:
-                logger.error(f"{self.name} no input content for task {task.task_id}")
-                self._update_execution_status(execution_id=task.execution_id, status="failed", error="No input content")
-                return True
-            
-            # Inject execution_id into content items for downstream executor use
-            for c in content:
-                c.summary_data["execution_id"] = task.execution_id
-            
-            # Execute pipeline synchronously (using asyncio.run)
-            result = self._run_pipeline(pipeline_config, content, task)
-            
-            if result and result.status == "completed":
-                self._update_execution_status(execution_id=task.execution_id, status="completed")
-                should_save_output = self._get_vault_should_save_output(task.vault_id)
-                try:
-                    self._save_execution_output(task.execution_id, result, should_save_output)
-                except cosmos_exceptions.CosmosHttpResponseError as ce:
-                    # check if it's due to request entity too large
-                    if ce.status_code == 413:
-                        
-                        logger.warning(f"Result too large to store for execution {task.execution_id}, skipping event data storage.")
-                        
-                        # update the data field in each content item to indicate data too large
-                        if isinstance(result.content, list):
-                            for c in result.content:
-                                c.data = {"data": "Output data too large to store in Cosmos DB. View output saved by output executor(s)."}
-                            self._save_execution_output(task.execution_id, result, should_save_output)
-                        else:
-                            result.content.data = {"data": "Output data too large to store in Cosmos DB. View output saved by output executor(s)."}
-                            self._save_execution_output(task.execution_id, result, should_save_output)
-                    
-                    else:
-                        logger.error(f"Failed to add result to execution {task.execution_id}: {ce}", exc_info=True)
-                        raise ce
-                
-                logger.debug(f"{self.name} task {task.task_id} completed successfully")
-                return True
-            elif result and result.status == "failed":
-                logger.error(f"{self.name} task {task.task_id} failed during execution: {result.error}")
-                self._update_execution_status(execution_id=task.execution_id, status="failed", error=result.error)
-                self._save_execution_output(task.execution_id, result, should_save_output=False)
-                return True
-            else:
-                self._update_execution_status(execution_id=task.execution_id, status=result.status, error="Pipeline execution has unknown status")
-                return True
-                
-        except Exception as e:
-            logger.error(f"{self.name} error executing task {task.task_id}: {e}")
-            logger.exception(e)
-            self._update_execution_status(task.execution_id, "failed", error=str(e))
-            return False
-    
-    def _run_pipeline(self, pipeline_config: dict, content: List[Content], task: ContentProcessingTask) -> PipelineResult:
-        """Run pipeline execution"""
-        try:
-            # Load pipeline executor
-            import yaml
-            
-            # Parse the YAML
-            _parsed_pipeline_config = yaml.safe_load(pipeline_config["yaml"])
-            
-            # If an input executor was already executed, remove it from the pipeline
-            if task.executed_input_executor:
-                logger.debug(f"{self.name} excluding already-executed input executor: {task.executed_input_executor}")
-                _parsed_pipeline_config = self._exclude_executor(_parsed_pipeline_config, task.executed_input_executor)
-            
-            
-            pipeline_definition = _parsed_pipeline_config.get('pipeline', _parsed_pipeline_config)
-            
-            # Create pipeline executor
-            async def execute():
-                async with PipelineExecutor.from_pipeline_definition_dict(
-                    pipeline_definition=pipeline_definition
-                ) as pipeline_executor:
-                    
-                    # Execute
-                    return await pipeline_executor.execute(content)
-            
-            # Run async pipeline
-            result = asyncio.run(execute())
-            
-            logger.debug(f"{self.name} pipeline execution result: {result.status}")
-            return result
-                
-        except Exception as e:
-            logger.error(f"{self.name} pipeline execution error: {e}")
-            logger.exception(e)
-            raise e
-    
-    def _exclude_executor(self, config: dict, executor_id: str) -> dict:
-        """
-        Exclude a specific executor from the pipeline configuration.
-        
-        Args:
-            config: Pipeline configuration
-            executor_id: ID of executor to exclude
-            
-        Returns:
-            Modified configuration with executor removed
-        """
-        try:
-            # Get pipeline definition
-            pipeline_def = config.get('pipeline', config)
-            
-            # Remove executor from executors list
-            if 'executors' in pipeline_def:
-                executors = pipeline_def['executors']
-                pipeline_def['executors'] = [
-                    ex for ex in executors 
-                    if ex.get('id') != executor_id
-                ]
-                logger.info(f"{self.name} removed executor {executor_id} from pipeline")
-            
-            # Remove executor from execution_sequence if present
-            if 'execution_sequence' in pipeline_def:
-                sequence = pipeline_def['execution_sequence']
-                if executor_id in sequence:
-                    pipeline_def['execution_sequence'] = [
-                        ex_id for ex_id in sequence 
-                        if ex_id != executor_id
-                    ]
-                    logger.info(f"{self.name} removed {executor_id} from execution_sequence")
-            
-            # Remove executor from edges if present
-            if 'edges' in pipeline_def:
-                edges = pipeline_def['edges']
-                pipeline_def['edges'] = [
-                    edge for edge in edges
-                    if edge.get('from') != executor_id and edge.get('to') != executor_id
-                ]
-                logger.info(f"{self.name} removed edges involving {executor_id}")
-            
-            return config
-            
-        except Exception as e:
-            logger.error(f"{self.name} error excluding executor: {e}")
-            return config
-    
-    def _get_pipeline(self, pipeline_id: str) -> Optional[dict]:
-        """Get pipeline configuration from Cosmos DB"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_PIPELINES)
-            
-            pipeline = container.read_item(item=pipeline_id, partition_key=pipeline_id)
-            return pipeline
-            
-        except Exception as e:
-            logger.error(f"{self.name} error reading pipeline {pipeline_id}: {e}")
-            return None
-    
-    def _update_execution_status(self, execution_id: str, status: str, error: Optional[str] = None):
-        """Update execution status in Cosmos DB"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS)
-            
-            # Read current execution
-            execution = container.read_item(item=execution_id, partition_key=execution_id)
-            
-            logger.debug(f"{self.name}: Retrieved execution {execution_id}. Current execution status: {execution.get('status')}")
-            
-            # Update status
-            execution["status"] = status
-            if status == "running":
-                execution["started_at"] = datetime.now(timezone.utc).isoformat()
-                execution["status_message"] = "Execution is running"
-            elif status in ["completed", "failed"]:
-                execution["completed_at"] = datetime.now(timezone.utc).isoformat()
-                execution["status_message"] = f"Execution {status}"
-                
-            if error:
-                execution["error"] = error
-                execution["status_message"] = f"Execution failed. View error details."
-            
-            execution["processing_worker_id"] = self.name
-            execution['updated_at'] = datetime.now(timezone.utc).isoformat()
-            
-            # Update in Cosmos DB
-            container.upsert_item(execution)
-            
-            logger.debug(f"{self.name} updated execution {execution_id} status to {status}")
-            
-        except Exception as e:
-            logger.error(f"{self.name} error updating execution {execution_id}. Error: {e}")
-            logger.exception(e)
-    
-    def _save_execution_output(self, execution_id: str, result: PipelineResult, should_save_output: bool = False):
-        """Save execution output to Cosmos DB"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS)
-            
-            # Read current execution
-            execution = container.read_item(item=execution_id, partition_key=execution_id)
-            
-            # Save output
-            if result.content is not None:
-                if should_save_output:
-                    if isinstance(result.content, list):
-                        execution["content"] = [make_safe_json(c) for c in result.content]
-                    else:
-                        execution["content"] = make_safe_json(result.content)
-                                        
-                else:
-                    # Only save content identifiers and execution metadata
-                    if isinstance(result.content, list):
-                        execution["content"] = [c.id.model_dump() for c in result.content]
-                    else:
-                        execution["content"] = result.content.id.model_dump()
-                        
-                execution["number_of_items"] = len(result.content) if isinstance(result.content, list) else 1
-            
-            execution['updated_at'] = datetime.now(timezone.utc).isoformat()
-            
-            # Update in Cosmos DB
-            container.upsert_item(execution)
-            
-            logger.debug(f"{self.name} saved output for execution {execution_id}")
-        
-        except Exception as e:
-            logger.error(f"{self.name} error saving execution output: {e}")
-            raise e
-    
-    def _get_vault_should_save_output(self, vault_id: str) -> bool:
-        """Get whether the vault is configured to save execution output"""
-        
-        if not vault_id:
-            return False
-        
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULTS)
-            
-            # Read current execution
-            vault = container.read_item(item=vault_id, partition_key=vault_id)
-            
-            return vault.get("save_execution_output", False)
-        
-        except Exception as e:
-            logger.error(f"{self.name} error getting vault save output flag: {e}")
-        
-        return False
-        
-    def _signal_handler(self, signum, frame):
-        """Handle shutdown signals"""
-        logger.info(f"{self.name} received signal {signum}")
-        self.stop_event.set()
diff --git a/contentflow-worker/app/worker/source_worker.py b/contentflow-worker/app/worker/source_worker.py
deleted file mode 100644
index 3614c25..0000000
--- a/contentflow-worker/app/worker/source_worker.py
+++ /dev/null
@@ -1,853 +0,0 @@
-"""
-Input source worker for loading and discovering content.
-
-This module implements the InputSourceWorker that:
-- Continuously runs with per-executor polling intervals
-- Polls Cosmos DB for pipelines associated with vaults
-- Uses distributed locking to prevent concurrent execution by multiple workers
-- Identifies and executes input executors from enabled pipelines
-- Creates content processing tasks for discovered content
-- Sends tasks to the processing queue
-"""
-import asyncio
-import logging
-import multiprocessing as mp
-import signal
-import sys
-import time
-import traceback
-import uuid
-import yaml
-from datetime import datetime, timezone, timedelta
-from pathlib import Path
-from typing import AsyncGenerator, Optional, List, Dict, Any
-
-# # Add contentflow-lib to path
-# lib_path = Path(__file__).parent.parent / "contentflow-lib"
-# if lib_path.exists():
-#     sys.path.insert(0, str(lib_path))
-
-from azure.identity import ChainedTokenCredential
-from azure.cosmos import CosmosClient
-from azure.cosmos.exceptions import CosmosResourceNotFoundError, CosmosResourceExistsError
-
-from contentflow.executors import BaseExecutor, InputExecutor
-from contentflow.executors.executor_config import ExecutorInstanceConfig
-from contentflow.models import Content
-from contentflow.executors import ExecutorRegistry
-from contentflow.utils import get_azure_credential, make_safe_json
-
-from app.models import ContentProcessingTask, TaskPriority
-from app.queue_client import TaskQueueClient
-from app.settings import WorkerSettings
-
-logger = logging.getLogger("contentflow.worker.source_worker")
-
-class InputSourceWorker:
-    """
-    Worker process for loading content from input sources.
-    
-    This worker:
-    1. Continuously runs with a scheduler that tracks next execution time per pipeline
-    2. Uses per-executor polling intervals from executor settings
-    3. Implements distributed locking via Cosmos DB to prevent concurrent execution
-    4. Polls Cosmos DB for pipelines associated with vaults (enabled pipelines)
-    5. Parses pipeline configuration to find input executors
-    6. Executes input executors to discover content
-    7. Creates ContentProcessingTask for each discovered content item
-    8. Sends processing tasks to the queue
-    """
-    
-    def __init__(
-        self,
-        worker_id: int,
-        settings: WorkerSettings,
-        stop_event
-    ):
-        """
-        Initialize the input source worker.
-        
-        Args:
-            worker_id: Unique worker identifier
-            settings: Worker configuration settings
-            stop_event: Multiprocessing event for graceful shutdown
-        """
-        self.worker_id = worker_id
-        self.settings = settings
-        self.stop_event = stop_event
-        self.name = f"InputSourceWorker-{worker_id}"
-        
-        # Azure clients (initialized in run)
-        self.credential: Optional[ChainedTokenCredential] = None
-        self.queue_client: Optional[TaskQueueClient] = None
-        self.cosmos_client: Optional[CosmosClient] = None
-        self.executor_registry: Optional[ExecutorRegistry] = None
-        
-        # Scheduling: Track next execution time for each pipeline
-        # Key: pipeline_id, Value: next_execution_time (datetime)
-        self.pipeline_schedule: Dict[str, datetime] = {}
-        
-        # Map of pipeline to vault
-        # Key: pipeline_id, Value: vault_id
-        self.pipeline_vaults: Dict[str, str] = {}
-        
-        # Track polling intervals per pipeline
-        # Key: pipeline_id, Value: polling_interval_seconds
-        self.pipeline_intervals: Dict[str, int] = {}
-        
-        logger.info(f"Initialized {self.name}")
-    
-    def run(self):
-        """Main worker loop with continuous scheduling"""
-        logger.info(f"{self.name} starting...")
-        
-        # Setup signal handlers for graceful shutdown
-        signal.signal(signal.SIGINT, self._signal_handler)
-        signal.signal(signal.SIGTERM, self._signal_handler)
-        
-        try:
-            # Initialize Azure clients
-            self._initialize_clients()
-            
-            # Main continuous scheduling loop
-            while not self.stop_event.is_set():
-                try:
-                    # Refresh pipeline list and schedule
-                    self._refresh_pipeline_schedule()
-                    
-                    # Process pipelines that are ready for execution
-                    asyncio.run(self._process_ready_pipelines())
-                    
-                    # Sleep briefly between schedule checks
-                    if not self.stop_event.is_set():
-                        time.sleep(self.settings.SCHEDULER_SLEEP_INTERVAL_SECONDS)
-                        
-                except Exception as e:
-                    logger.error(f"{self.name} error in scheduling loop: {e}")
-                    logger.error(traceback.format_exc())
-                    time.sleep(5)  # Back off on error
-                    
-        except KeyboardInterrupt:
-            logger.info(f"{self.name} received interrupt signal")
-        except Exception as e:
-            logger.error(f"{self.name} fatal error: {e}")
-            logger.error(traceback.format_exc())
-        finally:
-            logger.info(f"{self.name} shutting down...")
-    
-    def _initialize_clients(self):
-        """Initialize Azure clients"""
-        logger.info(f"{self.name} initializing Azure clients...")
-        
-        # Initialize credential
-        self.credential = get_azure_credential()
-        
-        # Initialize queue client
-        self.queue_client = TaskQueueClient(
-            queue_url=self.settings.STORAGE_ACCOUNT_WORKER_QUEUE_URL,
-            queue_name=self.settings.STORAGE_WORKER_QUEUE_NAME,
-            credential=self.credential
-        )
-        
-        # Initialize Cosmos DB client
-        self.cosmos_client = CosmosClient(
-            url=self.settings.COSMOS_DB_ENDPOINT,
-            credential=self.credential
-        )
-        
-        self.executor_registry = ExecutorRegistry.load_default_catalog()  # Load default executors
-        
-        logger.info(f"{self.name} clients initialized")
-    
-    def _refresh_pipeline_schedule(self):
-        """Refresh the list of pipelines and their schedules"""
-        try:
-            # Get pipelines with vaults
-            vault_pipelines = self._get_pipelines_with_vaults()
-            
-            current_time = datetime.now(timezone.utc)
-            
-            # Update schedule for new or modified pipelines
-            for vault_id, pipeline_id in vault_pipelines:
-                
-                # If pipeline is new to schedule, add it
-                if pipeline_id not in self.pipeline_schedule:
-                    # Get polling interval from executor settings
-                    interval = self._get_pipeline_polling_interval(pipeline_id)
-                    self.pipeline_intervals[pipeline_id] = interval
-                    
-                    # Schedule for immediate execution (first run)
-                    self.pipeline_schedule[pipeline_id] = current_time
-                    self.pipeline_vaults[pipeline_id] = vault_id
-                    
-                    logger.info(
-                        f"{self.name} added pipeline {pipeline_id} "
-                        f"with {interval}s polling interval"
-                    )
-            
-            # Remove pipelines that are no longer active
-            active_pipeline_ids = set([pipeline_id for _, pipeline_id in vault_pipelines])
-            inactive_pipeline_ids = set(self.pipeline_schedule.keys()) - active_pipeline_ids
-            
-            for inactive_id in inactive_pipeline_ids:
-                del self.pipeline_schedule[inactive_id]
-                del self.pipeline_intervals[inactive_id]
-                del self.pipeline_vaults[inactive_id]
-                logger.info(f"{self.name} removed inactive pipeline {inactive_id}")
-                
-        except Exception as e:
-            logger.error(f"{self.name} error refreshing pipeline schedule: {e}")
-            logger.error(traceback.format_exc())
-    
-    def _get_pipeline_polling_interval(self, pipeline_id: str) -> int:
-        """Extract polling interval from pipeline's input executor settings"""
-        try:
-            pipeline = self._get_pipeline_by_id(pipeline_id)
-            
-            # Find input executor
-            input_executor_config = self._find_input_executor(pipeline)
-            
-            if not input_executor_config:
-                return self.settings.DEFAULT_POLLING_INTERVAL_SECONDS
-            
-            # Check for polling_interval_seconds in executor settings
-            settings = input_executor_config.get('settings', {})
-            interval = settings.get('polling_interval_seconds')
-            
-            if interval and isinstance(interval, (int, float)) and interval > 0:
-                return int(interval)
-            
-            # Default fallback
-            return self.settings.DEFAULT_POLLING_INTERVAL_SECONDS
-            
-        except Exception as e:
-            logger.error(f"{self.name} error getting polling interval: {e}")
-            return self.settings.DEFAULT_POLLING_INTERVAL_SECONDS
-    
-    async def _process_ready_pipelines(self):
-        """Process pipelines that are ready for execution"""
-        current_time = datetime.now(timezone.utc)
-        
-        for pipeline_id, next_execution_time in list(self.pipeline_schedule.items()):
-            if self.stop_event.is_set():
-                break
-            
-            # Check if pipeline is ready to execute
-            if current_time >= next_execution_time:
-                try:
-                    # Try to acquire lock for this pipeline
-                    if self._acquire_lock(pipeline_id):
-                        try:
-                            # Get pipeline details
-                            pipeline = self._get_pipeline_by_id(pipeline_id)
-                            
-                            if pipeline:
-                                # Process the pipeline
-                                await self._process_pipeline(pipeline)
-                                
-                                # Update next execution time
-                                interval = self.pipeline_intervals.get(
-                                    pipeline_id,
-                                    self.settings.DEFAULT_POLLING_INTERVAL_SECONDS
-                                )
-                                next_time = current_time + timedelta(seconds=interval)
-                                self.pipeline_schedule[pipeline_id] = next_time
-                                
-                                logger.debug(
-                                    f"{self.name} scheduled next execution for "
-                                    f"{pipeline.get('name')} at {next_time.isoformat()}"
-                                )
-                        finally:
-                            # Always release lock
-                            self._release_lock(pipeline_id)
-                    else:
-                        logger.debug(
-                            f"{self.name} could not acquire lock for pipeline {pipeline_id}, "
-                            "another worker is processing it"
-                        )
-                        
-                except Exception as e:
-                    logger.error(f"{self.name} error processing pipeline {pipeline_id}: {e}")
-                    logger.error(traceback.format_exc())
-    
-    def _acquire_lock(self, pipeline_id: str) -> bool:
-        """
-        Attempt to acquire a distributed lock for a pipeline.
-        
-        Uses Cosmos DB for distributed locking with TTL for auto-cleanup.
-        
-        Args:
-            pipeline_id: Pipeline identifier
-            
-        Returns:
-            True if lock acquired, False otherwise
-        """
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS)
-            
-            lock_id = f"pipeline_{pipeline_id}_lock"
-            current_time = datetime.now(timezone.utc)
-            value_id = self.pipeline_vaults.get(pipeline_id, None)
-            
-            lock_doc = {
-                "id": lock_id,
-                "pipeline_id": pipeline_id,
-                "vault_id": value_id,
-                "worker_id": self.name,
-                "locked_at": current_time.isoformat(),
-                "ttl": self.settings.LOCK_TTL_SECONDS  # Auto-expire after TTL
-            }
-            
-            try:
-                # Try to create lock document (will fail if already exists)
-                container.create_item(lock_doc)
-                logger.debug(f"{self.name} acquired lock for pipeline {pipeline_id}")
-                return True
-                
-            except CosmosResourceExistsError:
-                # Lock already exists, check if it's stale
-                try:
-                    existing_lock = container.read_item(
-                        item=lock_id,
-                        partition_key=lock_id
-                    )
-                    
-                    locked_at = datetime.fromisoformat(existing_lock['locked_at'])
-                    age_seconds = (current_time - locked_at).total_seconds()
-                    
-                    # If lock is older than TTL, it should have been cleaned up
-                    # but in case TTL cleanup is delayed, we can force delete
-                    if age_seconds > self.settings.LOCK_TTL_SECONDS:
-                        logger.warning(
-                            f"{self.name} found stale lock for pipeline {pipeline_id}, "
-                            f"age: {age_seconds}s"
-                        )
-                        container.delete_item(item=lock_id, partition_key=lock_id)
-                        # Try to acquire again
-                        return self._acquire_lock(pipeline_id)
-                    
-                    logger.debug(
-                        f"{self.name} pipeline {pipeline_id} locked by "
-                        f"{existing_lock.get('worker_id')}"
-                    )
-                    return False
-                    
-                except CosmosResourceNotFoundError:
-                    # Lock was deleted between our attempts, try again
-                    return self._acquire_lock(pipeline_id)
-                    
-        except Exception as e:
-            logger.error(f"{self.name} error acquiring lock: {e}")
-            logger.error(traceback.format_exc())
-            return False
-    
-    def _release_lock(self, pipeline_id: str):
-        """
-        Release a distributed lock for a pipeline.
-        
-        Args:
-            pipeline_id: Pipeline identifier
-        """
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTION_LOCKS)
-            
-            lock_id = f"pipeline_{pipeline_id}_lock"
-            
-            try:
-                # Verify we own the lock before deleting
-                existing_lock = container.read_item(
-                    item=lock_id,
-                    partition_key=lock_id
-                )
-                
-                if existing_lock.get('worker_id') == self.name:
-                    container.delete_item(item=lock_id, partition_key=lock_id)
-                    logger.debug(f"{self.name} released lock for pipeline {pipeline_id}")
-                else:
-                    logger.warning(
-                        f"{self.name} attempted to release lock owned by "
-                        f"{existing_lock.get('worker_id')}"
-                    )
-                    
-            except CosmosResourceNotFoundError:
-                # Lock already released or expired
-                logger.debug(f"{self.name} lock for pipeline {pipeline_id} already released")
-                
-        except Exception as e:
-            logger.error(f"{self.name} error releasing lock: {e}")
-            logger.error(traceback.format_exc())
-    
-    def _get_pipeline_by_id(self, pipeline_id: str) -> Optional[Dict[str, Any]]:
-        """Get pipeline by ID from Cosmos DB"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_PIPELINES)
-            
-            pipeline = container.read_item(
-                item=pipeline_id,
-                partition_key=pipeline_id
-            )
-            
-            return pipeline
-            
-        except CosmosResourceNotFoundError:
-            logger.warning(f"{self.name} pipeline {pipeline_id} not found")
-            return None
-        except Exception as e:
-            logger.error(f"{self.name} error getting pipeline: {e}")
-            return None
-    
-    def _get_pipelines_with_vaults(self) -> List[tuple[str,str]]:
-        """Get enabled pipelines that have associated vaults"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            
-            # Query vaults container for enabled vaults
-            vaults_container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULTS)
-            vault_pipelines = list(vaults_container.query_items(
-                query="SELECT DISTINCT c.id, c.pipeline_id FROM c WHERE c.enabled = true",
-                enable_cross_partition_query=True
-            ))
-            return [(vp["id"], vp["pipeline_id"]) for vp in vault_pipelines]
-            
-        except Exception as e:
-            logger.error(f"{self.name} error querying pipelines: {e}")
-            logger.error(traceback.format_exc())
-            return []
-    
-    async def _process_pipeline(self, pipeline: Dict[str, Any]):
-        """Process a single pipeline"""
-        pipeline_id = pipeline.get('id')
-        pipeline_name = pipeline.get('name')
-        
-        logger.info(f"{self.name}: processing pipeline '{pipeline_name}'")
-        
-        try:
-            # Parse pipeline YAML to find input executor
-            input_executor_config = self._find_input_executor(pipeline)
-            
-            if not input_executor_config:
-                logger.warning(f"{self.name}: no input executor found in pipeline {pipeline_name}")
-                return
-            
-            executor_id = input_executor_config.get('id')
-            logger.debug(f"{self.name}: found input executor: {executor_id}")
-            
-            # Retrieve checkpoint before execution
-            checkpoint_timestamp = self._get_checkpoint(pipeline_id, executor_id)
-            if checkpoint_timestamp:
-                logger.debug(f"{self.name}: resuming from checkpoint {checkpoint_timestamp.isoformat()}")
-            else:
-                logger.debug(f"{self.name}: no checkpoint found, starting fresh")
-            
-            # Track the latest timestamp for checkpoint
-            latest_timestamp = checkpoint_timestamp
-            execution_start_time = datetime.now(timezone.utc)
-            tasks_created = 0
-            
-            # Execute input executor to discover content
-            async for content_items in self._execute_input_executor(pipeline_id=pipeline_id, 
-                                                                    pipeline_name=pipeline_name, 
-                                                                    executor_config=input_executor_config, 
-                                                                    checkpoint_timestamp=checkpoint_timestamp):
-                if content_items is None:
-                    logger.debug(f"{self.name}: no content discovered from pipeline {pipeline_name}")
-                    self._create_no_content_discovered_execution_record(pipeline_id, pipeline_name)
-                    break
-            
-                logger.debug(f"{self.name}: discovered {len(content_items)} content items")
-                
-                # Skip if no content, this might be the case if content is retrieved from the source but filtered out by the input executor
-                if len(content_items) == 0:
-                    continue
-                
-                # Create processing tasks for each content item
-                try:
-                    self._create_processing_task(pipeline, content_items, executor_id)
-                    logger.debug(f"{self.name}: queued processing task for content with {len(content_items)} items")
-                    
-                    tasks_created += 1
-                except Exception as e:
-                    logger.error(f"{self.name}: failed to create processing task: {e}")
-                    logger.exception(e)
-                    
-                if self.stop_event.is_set():
-                    break
-            
-            logger.info(f"{self.name}: created {tasks_created} processing tasks for pipeline {pipeline_name}")
-            
-            # Save checkpoint after successful execution
-            # Use start time as the checkpoint for next execution
-            latest_timestamp = execution_start_time
-            self._save_checkpoint(pipeline_id, executor_id, latest_timestamp)
-            
-        except Exception as e:
-            logger.error(f"{self.name}: error processing pipeline {pipeline_name}: {e}")
-            logger.exception(e)
-    
-    def _find_input_executor(self, pipeline: Dict[str, Any]) -> Optional[Dict[str, Any]]:
-        """Find the input executor in the pipeline configuration"""
-        try:
-            yaml_content = pipeline.get('yaml')
-            if not yaml_content:
-                return None
-            
-            # Parse YAML
-            config = yaml.safe_load(yaml_content)
-            if not config:
-                return None
-            
-            # Get pipeline definition
-            pipeline_def = config.get('pipeline', config)
-            executors = pipeline_def.get('executors', [])
-            
-            # find the executor with input type by cross checking the executor-registry
-            for executor in executors:
-                executor_type = executor.get('type', '').lower()
-                executor_info = self.executor_registry.get_executor_info(executor_type)
-                if not executor_info:
-                    continue
-                
-                if executor_info.category == 'input':
-                    # Will always return the first input executor found
-                    logger.debug(f"{self.name} found input executor: {executor.get('id')}")
-                    return executor
-            
-            return None
-            
-        except Exception as e:
-            logger.error(f"{self.name} error parsing pipeline YAML: {e}")
-            return None
-    
-    async def _execute_input_executor(self, 
-                                      pipeline_id: str, 
-                                      pipeline_name:str, 
-                                      executor_config: Dict[str, Any], 
-                                      checkpoint_timestamp: Optional[datetime] = None
-                                      ) -> AsyncGenerator[List[Content], None]:
-        
-        """Execute an input executor to discover content"""
-        executor_type = executor_config.get('type')
-        executor_id = executor_config.get('id')
-        settings = executor_config.get('settings', {})
-        
-        logger.debug(f"{self.name}: executing input executor {executor_id} (type: {executor_type}) with checkpoint {checkpoint_timestamp}")
-        
-        try:
-            # Create executor instance
-            executor = self._create_executor(executor_type, executor_id, settings)
-            
-            if not executor or not isinstance(executor, InputExecutor):
-                logger.error(f"{self.name}: failed to create executor of type {executor_type}. Returned {executor} which is not an InputExecutor.")
-                # create an execution record with failed status
-                self._create_failed_execution_record(pipeline_id=pipeline_id, 
-                                                     pipeline_name=pipeline_name, 
-                                                     error_message=f"{self.name}: failed to create executor of type {executor_type}, got {executor} which is not an InputExecutor.")
-                return
-            
-            # Execute to discover content
-            async for batch, has_more in executor.crawl(checkpoint_timestamp=checkpoint_timestamp):
-                # Ensure we have a list
-                if batch is not None:
-                    yield batch
-                
-                if batch is None and has_more is False:
-                    # No more items
-                    yield None
-        
-        except Exception as e:
-            logger.error(f"{self.name}: error executing input executor: {e}")
-            logger.exception(e)
-            # Don't save checkpoint on error - will retry from last successful checkpoint
-            # create an execution record with failed status
-            self._create_failed_execution_record(pipeline_id=pipeline_id, 
-                                                 pipeline_name=pipeline_name, 
-                                                 error_message=f"{self.name}: {str(e)}. {traceback.format_exc()}")
-            raise
-    
-    def _create_executor(self, executor_type: str, executor_id: str, settings: Dict[str, Any]) -> BaseExecutor:
-        """Create an executor instance"""
-        try:
-            # Create instance config
-            instance_config = ExecutorInstanceConfig(
-                id=executor_id,
-                type=executor_type,
-                settings=settings
-            )
-            
-            # Create executor using registry (dynamic loading)
-            executor = self.executor_registry.create_executor_instance(
-                executor_id=executor_type,
-                instance_config=instance_config
-            )
-            
-            return executor
-            
-        except Exception as e:
-            logger.error(f"{self.name} error creating executor: {e}")
-            logger.exception(e)
-            raise
-    
-    def _create_execution_id(self) -> str:
-        """Generate a unique execution ID"""
-        return f"exec_{uuid.uuid4().hex[:12]}"
-    
-    def _create_processing_task(
-        self,
-        pipeline: Dict[str, Any],
-        content: List[Content],
-        executed_input_executor: str
-    ):
-        """Create and queue a content processing task"""
-        # Create execution record in Cosmos DB
-        execution_id = self._create_execution_id()
-        vault_id = self.pipeline_vaults.get(pipeline['id'], None)
-        
-        # Create processing task
-        processing_task = ContentProcessingTask(
-            task_id=f"task_{uuid.uuid4().hex[:12]}",
-            priority=TaskPriority.NORMAL,
-            pipeline_id=pipeline['id'],
-            pipeline_name=pipeline['name'],
-            vault_id=vault_id,
-            execution_id=execution_id,
-            content=content,
-            executed_input_executor=executed_input_executor,  # Mark which executor was already run
-            max_retries=self.settings.MAX_TASK_RETRIES
-        )
-        
-        try:
-            # Create execution record
-            self._create_execution_record(execution_id, processing_task)
-            
-            try:
-                # Send to queue
-                self.queue_client.send_content_processing_task(processing_task)
-            except Exception as e:
-                logger.error(f"{self.name} error sending processing task to queue: {e}")
-                # Mark execution as failed in Cosmos DB
-                self._mark_execution_failed(execution_id, str(e))
-                raise
-            
-            logger.debug(f"{self.name} created processing task for {len(content)} content items")
-        except Exception as e:
-            logger.error(f"{self.name} error execution record or queue creating processing task: {e}")
-            raise
-        
-    def _create_execution_record(
-        self,
-        execution_id: str,
-        task: ContentProcessingTask
-    ):
-        """Create execution record in Cosmos DB"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS)
-            
-            vault_id = self.pipeline_vaults.get(task.pipeline_id, None)
-            
-            execution = {
-                "id": execution_id,
-                "pipeline_id": task.pipeline_id,
-                "pipeline_name": task.pipeline_name,
-                "vault_id": vault_id,
-                "status": "pending",
-                "status_message": "Task queued for processing with input content of size " + str(len(task.content)),
-                "task_id": task.task_id,
-                "source_worker_id": self.name,
-                "content": [make_safe_json(c) for c in task.content],
-                "number_of_items": len(task.content) if task.content else 0,
-                "created_at": datetime.now(timezone.utc).isoformat(),
-                "created_by": self.name,
-                "updated_at": datetime.now(timezone.utc).isoformat(),
-                "started_at": None,
-                "completed_at": None,
-                "error": None,
-                "executor_outputs": {},
-                "events": []
-            }
-            
-            container.create_item(execution)
-            logger.debug(f"{self.name} created execution record {execution_id}")
-        except Exception as e:
-            logger.error(f"{self.name} error creating execution record: {e}")
-            raise
-    
-    def _create_no_content_discovered_execution_record(self, pipeline_id: str, pipeline_name: str):
-        """Create an execution record for no content discovered"""
-        try:
-            execution_id = self._create_execution_id()
-            
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS)
-            
-            vault_id = self.pipeline_vaults.get(pipeline_id, None)
-            
-            execution = {
-                "id": execution_id,
-                "pipeline_id": pipeline_id,
-                "pipeline_name": pipeline_name,
-                "vault_id": vault_id,
-                "status": "completed",
-                "status_message": "No content discovered during execution",
-                "task_id": None,
-                "source_worker_id": self.name,
-                "error": None,
-                "content": None,
-                "number_of_items": None,
-                "created_at": datetime.now(timezone.utc).isoformat(),
-                "created_by": self.name,
-                "updated_at": datetime.now(timezone.utc).isoformat(),
-                "started_at": None,
-                "completed_at": datetime.now(timezone.utc).isoformat(),
-                "executor_outputs": {},
-                "events": []
-            }
-            
-            container.create_item(execution)
-            logger.debug(f"{self.name} created no-content-discovered execution record {execution_id}")
-        except Exception as e:
-            logger.error(f"{self.name} error creating no-content-discovered execution record: {e}")
-            raise
-    
-    def _create_failed_execution_record(self, pipeline_id: str, pipeline_name: str, error_message: str):
-        """Create a failed execution record in Cosmos DB"""
-        try:
-            execution_id = self._create_execution_id()
-            
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS)
-            
-            vault_id = self.pipeline_vaults.get(pipeline_id, None)
-            
-            execution = {
-                "id": execution_id,
-                "pipeline_id": pipeline_id,
-                "pipeline_name": pipeline_name,
-                "vault_id": vault_id,
-                "status": "failed",
-                "status_message": "Execution failed. View error for details.",
-                "task_id": None,
-                "source_worker_id": self.name,
-                "content": None,
-                "number_of_items": None,
-                "error": error_message,
-                "created_at": datetime.now(timezone.utc).isoformat(),
-                "created_by": self.name,
-                "updated_at": datetime.now(timezone.utc).isoformat(),
-                "started_at": None,
-                "completed_at": None,
-                "executor_outputs": {},
-                "events": []
-            }
-            
-            container.create_item(execution)
-            logger.debug(f"{self.name} created failed execution record {execution_id}")
-        except Exception as e:
-            logger.error(f"{self.name} error creating failed execution record: {e}")
-            raise
-        
-    def _mark_execution_failed(self, execution_id: str, error_message: str):
-        """Mark an execution as failed in Cosmos DB"""
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_VAULT_EXECUTIONS)
-            
-            # Read existing execution
-            execution = container.read_item(
-                item=execution_id,
-                partition_key=execution_id
-            )
-            
-            # Update status and error message
-            execution['status'] = 'failed'
-            execution['status_message'] = "Execution failed. View error for details."
-            execution['error'] = error_message
-            execution['updated_at'] = datetime.now(timezone.utc).isoformat()
-            
-            container.upsert_item(body=execution)
-            logger.debug(f"{self.name} marked execution {execution_id} as failed")
-            
-        except Exception as e:
-            logger.error(f"{self.name} error marking execution as failed: {e}")
-    
-    def _get_checkpoint(self, pipeline_id: str, executor_id: str) -> Optional[datetime]:
-        """
-        Retrieve the last checkpoint timestamp for a pipeline's input executor.
-        
-        Args:
-            pipeline_id: Pipeline identifier
-            executor_id: Executor identifier
-            
-        Returns:
-            Last checkpoint timestamp, or None if no checkpoint exists
-        """
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS)
-            
-            checkpoint_id = f"{pipeline_id}_{executor_id}"
-            
-            try:
-                checkpoint_doc = container.read_item(
-                    item=checkpoint_id,
-                    partition_key=checkpoint_id
-                )
-                
-                timestamp_str = checkpoint_doc.get('checkpoint_timestamp')
-                if timestamp_str:
-                    return datetime.fromisoformat(timestamp_str)
-                
-                return None
-                
-            except CosmosResourceNotFoundError:
-                # No checkpoint exists yet
-                logger.debug(f"{self.name} no checkpoint found for {pipeline_id}/{executor_id}")
-                return None
-                
-        except Exception as e:
-            logger.error(f"{self.name} error retrieving checkpoint: {e}")
-            logger.error(traceback.format_exc())
-            # Return None to start fresh on error
-            return None
-    
-    def _save_checkpoint(self, pipeline_id: str, executor_id: str, checkpoint_timestamp: datetime):
-        """
-        Save a checkpoint timestamp for a pipeline's input executor.
-        
-        Args:
-            pipeline_id: Pipeline identifier
-            executor_id: Executor identifier
-            checkpoint_timestamp: Timestamp to save as checkpoint
-        """
-        try:
-            database = self.cosmos_client.get_database_client(self.settings.COSMOS_DB_NAME)
-            container = database.get_container_client(self.settings.COSMOS_DB_CONTAINER_CRAWL_CHECKPOINTS)
-            
-            vault_id = self.pipeline_vaults.get(pipeline_id, None)
-            checkpoint_id = f"{pipeline_id}_{executor_id}"
-            
-            checkpoint_doc = {
-                "id": checkpoint_id,
-                "pipeline_id": pipeline_id,
-                "vault_id": vault_id,
-                "executor_id": executor_id,
-                "checkpoint_timestamp": checkpoint_timestamp.isoformat(),
-                "worker_id": self.name
-            }
-            
-            # Upsert the checkpoint (create or update)
-            container.upsert_item(checkpoint_doc)
-            logger.debug(f"{self.name} saved checkpoint for {pipeline_id}/{executor_id}")
-            
-        except Exception as e:
-            logger.error(f"{self.name} error saving checkpoint: {e}")
-            logger.error(traceback.format_exc())
-            # Log error but don't fail the execution
-    
-    def _signal_handler(self, signum, frame):
-        """Handle shutdown signals"""
-        logger.info(f"{self.name} received signal {signum}")
-        self.stop_event.set()
diff --git a/contentflow-worker/main.py b/contentflow-worker/main.py
deleted file mode 100644
index 80a86d5..0000000
--- a/contentflow-worker/main.py
+++ /dev/null
@@ -1,116 +0,0 @@
-"""
-ContentFlow Worker - Multi-processing content processing engine.
-
-This is the main entry point for the ContentFlow worker service.
-It starts the worker engine which manages processing and source workers.
-It also starts a FastAPI health/status monitoring API.
-"""
-import logging
-import sys
-import threading
-from pathlib import Path
-import uvicorn
-
-from contentflow.utils import setup_logging
-
-from app.engine import WorkerEngine
-from app.settings import get_settings, WorkerSettings
-from app.startup import run_startup_checks
-from app.api import create_app
-
-def print_worker_banner():
-    """Print worker banner"""
-    banner = """
-    ╔════════════════════════════════════════════════════════╗
-    ║                                                        ║
-    ║       ◆                                                ║
-    ║      / ╲                                               ║
-    ║     /   ╲              ContentFlow                     ║
-    ║    ◆     ◆                                             ║
-    ║     ╲   /              Worker Service                  ║
-    ║      ╲ /                                               ║
-    ║       ◆                                                ║
-    ║                                                        ║
-    ╚════════════════════════════════════════════════════════╝
-    """
-    print(banner)
-    
-
-def main(settings: WorkerSettings):
-    """Main entry point"""
-    
-    print_worker_banner()
-    print("=" * 60)
-    print("ContentFlow Worker Service")
-    print("=" * 60)
-    print(f"Worker Name: {settings.WORKER_NAME}")
-    print(f"Processing Workers: {settings.NUM_PROCESSING_WORKERS}")
-    print(f"Source Workers: {settings.NUM_SOURCE_WORKERS}")
-    print(f"Queue: {settings.STORAGE_WORKER_QUEUE_NAME}")
-    if settings.API_ENABLED:
-        print(f"API Enabled: http://{settings.API_HOST}:{settings.API_PORT}")
-    print("=" * 60)
-    
-    # Run startup checks with retries (Azure services may need time for DNS/RBAC propagation)
-    import time
-    max_startup_retries = 5
-    print("Running startup validation checks...")
-    for _attempt in range(max_startup_retries):
-        if run_startup_checks(settings):
-            print("✅ Startup validation passed.")
-            break
-        wait = min(30, 5 * (_attempt + 1))
-        print(f"⏳ Startup check failed (attempt {_attempt + 1}/{max_startup_retries}), retrying in {wait}s...")
-        time.sleep(wait)
-    else:
-        print("\033[93m⚠️ Startup validation did not pass after retries, continuing with available config...\033[0m")
-    
-    # Create worker engine
-    print("Creating worker engine...")
-    engine = WorkerEngine(settings)
-    
-    # Start API server in a separate thread if enabled
-    api_thread = None
-    if settings.API_ENABLED:
-        print(f"Starting API server on {settings.API_HOST}:{settings.API_PORT}...")
-        app = create_app(settings, engine)
-        
-        # Run uvicorn in a separate thread
-        api_thread = threading.Thread(
-            target=uvicorn.run,
-            kwargs={
-                "app": app,
-                "reload": False,
-                "host": settings.API_HOST,
-                "port": settings.API_PORT,
-                "log_level": settings.LOG_LEVEL.lower(),
-                "log_config": None  # Disable uvicorn's default logging config
-            },
-            daemon=True,
-            name="APIServerThread"
-        )
-        api_thread.start()
-        print("✅ API server started.")
-    
-    print("Starting worker engine...")
-    
-    try:
-        # Run the worker engine (blocking)
-        engine.run()
-        
-    except Exception as e:
-        print(f"\033[91m🚨 Fatal error: {e}\033[0m")
-        sys.exit(1)
-    finally:
-        # Cleanup
-        if api_thread and api_thread.is_alive():
-            print("API server will stop with the main process...")
-    
-    print("Worker service stopped")
-
-settings = get_settings()
-setup_logging(settings.LOG_LEVEL)
-
-
-if __name__ == "__main__":
-    main(settings)
\ No newline at end of file
diff --git a/contentflow-worker/requirements.txt b/contentflow-worker/requirements.txt
deleted file mode 100644
index 3ecab87..0000000
--- a/contentflow-worker/requirements.txt
+++ /dev/null
@@ -1,17 +0,0 @@
-# ContentFlow Worker Dependencies
-
-# Core dependencies
-pydantic>=2.12.5
-pydantic-settings==2.12.0
-python-dotenv>=1.2.1
-pyyaml>=6.0.3
-
-# Azure SDK
-azure-identity==1.25.1
-azure-storage-queue==12.14.1
-azure-cosmos==4.14.3
-azure-storage-blob==12.27.1
-
-# FastAPI framework
-fastapi==0.128.0
-uvicorn[standard]==0.40.0
\ No newline at end of file
diff --git a/infra/bicep/main.bicep b/infra/bicep/main.bicep
index 54afeaa..7d2ebcf 100644
--- a/infra/bicep/main.bicep
+++ b/infra/bicep/main.bicep
@@ -93,17 +93,6 @@ param docsContainerName string = 'content'
 @description('API Container App target port')
 param apiContainerAppTargetPort int = 8090
 
-/* --- WORKER DISABLED: uncomment to re-enable worker container app ---
-@description('Worker Container App target port')
-param workerContainerAppTargetPort int = 8099
-
-@description('Enable API service in worker container app - used for health checks')
-param workerAPIEnabled bool = true
-
-@description('Queue name for worker tasks')
-param workerQueueName string = 'contentflow-execution-requests'
---- END WORKER DISABLED */
-
 // ========== DEPLOYMENT MODE VALIDATION ==========
 var isBasic = deploymentMode == 'basic'
 var isAILZIntegrated = deploymentMode == 'ailz-integrated'
@@ -164,7 +153,6 @@ var appConfigStoreName = 'appcs-${resourceToken}'
 var containerRegistryName = 'cr${resourceToken}'
 var containerAppsEnvironmentName = 'cae-${resourceToken}'
 var apiContainerAppName = 'api-${resourceToken}'
-// WORKER DISABLED: var workerContainerAppName = 'worker-${resourceToken}'
 var webContainerAppName = 'web-${resourceToken}'
 
 // ========== MODULES DEPLOYMENT =========
@@ -321,18 +309,6 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         name: 'contentflow.common.BLOB_STORAGE_CONTAINER_NAME'
         value: docsContainerName
       }
-      /* WORKER DISABLED: uncomment to re-enable queue App Config keys
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.common.STORAGE_ACCOUNT_WORKER_QUEUE_URL'
-        value: storage!.outputs.primaryQueueEndpoint
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.common.STORAGE_WORKER_QUEUE_NAME'
-        value: workerQueueName
-      }
-      */
       // API settings
       {
         contentType: 'text/plain'
@@ -374,85 +350,6 @@ module appConfigStoreKeys 'modules/app-config-store-keys.bicep' = {
         name: 'contentflow.api.CORS_ALLOW_ORIGINS'
         value: '*'
       }
-      // NOTE: WORKER_ENGINE_API_ENDPOINT moved to apiContainerApp env vars to break circular dependency
-      /* --- WORKER DISABLED: uncomment to re-enable worker App Config keys ---
-      // Worker settings
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.NUM_PROCESSING_WORKERS'
-        value: '4'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.NUM_SOURCE_WORKERS'
-        value: '2'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.LOG_LEVEL'
-        value: 'INFO'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.DEBUG'
-        value: 'false'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.API_ENABLED'
-        value: '${workerAPIEnabled}'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.API_HOST'
-        value: '0.0.0.0'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.API_PORT'
-        value: '${workerContainerAppTargetPort}'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.QUEUE_POLL_INTERVAL_SECONDS'
-        value: '5'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.QUEUE_VISIBILITY_TIMEOUT_SECONDS'
-        value: '300'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.QUEUE_MAX_MESSAGES'
-        value: '32'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.MAX_TASK_RETRIES'
-        value: '3'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.TASK_TIMEOUT_SECONDS'
-        value: '600'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.DEFAULT_POLLING_INTERVAL_SECONDS'
-        value: '60'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.SCHEDULER_SLEEP_INTERVAL_SECONDS'
-        value: '5'
-      }
-      {
-        contentType: 'text/plain'
-        name: 'contentflow.worker.LOCK_TTL_SECONDS'
-        value: '300'
-      }
-      --- END WORKER DISABLED */
       {
         contentType: 'text/plain'
         name: 'sentinel'
@@ -568,12 +465,6 @@ module apiContainerApp 'modules/container-app.bicep' = {
         name: 'AZURE_CLIENT_ID'
         value: userAssignedIdentity.outputs.clientId
       }
-      /* WORKER DISABLED: uncomment to re-enable worker endpoint
-      {
-        name: 'WORKER_ENGINE_API_ENDPOINT'
-        value: 'https://${workerContainerApp.outputs.fqdn}'
-      }
-      */
       {
         name: 'AZURE_STORAGE_ACCOUNT_NAME'
         value: storageAccountName
@@ -591,55 +482,6 @@ module apiContainerApp 'modules/container-app.bicep' = {
   }
 }
 
-/* --- WORKER DISABLED: uncomment to re-enable worker container app ---
-// ========== WORKER CONTAINER APP ==========
-module workerContainerApp 'modules/container-app.bicep' = {
-  name: 'ca-worker-${resourceToken}'
-  params: {
-    name: workerContainerAppName
-    location: containerAppsEnvironment.outputs.location
-    containerAppsEnvId: containerAppsEnvironment.outputs.resourceId
-    containerRegistryServer: containerRegistry!.outputs.loginServer
-    managedIdentityId: userAssignedIdentity.outputs.resourceId
-    targetPort: workerContainerAppTargetPort
-    externalIngress: true
-    corsEnabled: true
-    livenessProbePath: '' // Disabled for initial provisioning with placeholder image
-    cpuCores: 2
-    memoryInGB: '4Gi'
-    minReplicas: 0 // Set to 0 for initial provisioning - container will scale up when real image is deployed
-    maxReplicas: 3
-    environmentVariables: [
-      {
-        name: 'AZURE_APP_CONFIG_ENDPOINT'
-        value: appConfigStore!.outputs.endpoint
-      }
-      {
-        name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
-        value: appInsightsConnectionString
-      }
-      {
-        name: 'AZURE_CLIENT_ID'
-        value: userAssignedIdentity.outputs.clientId
-      }
-      {
-        name: 'AZURE_STORAGE_ACCOUNT_NAME'
-        value: storageAccountName
-      }
-      {
-        name: 'AZURE_CONTENT_UNDERSTANDING_ENDPOINT'
-        value: 'https://${aiFoundry.outputs.aiServicesName}.services.ai.azure.com'
-      }
-      {
-        name: 'AZURE_OPENAI_ENDPOINT'
-        value: 'https://${aiFoundry.outputs.aiServicesName}.services.ai.azure.com'
-      }
-    ]
-    tags: union(tags, { 'azd-service-name': 'worker' })
-  }
-}
---- END WORKER DISABLED */
-
 // ========== WEB CONTAINER APP ==========
 module webContainerApp 'modules/container-app.bicep' = {
   name: 'ca-web-${resourceToken}'
@@ -679,7 +521,6 @@ output AZURE_CONTAINER_REGISTRY_NAME string = containerRegistry.outputs.name
 
 // Service endpoints
 output API_ENDPOINT string = 'https://${apiContainerApp.outputs.fqdn}'
-// WORKER DISABLED: output WORKER_ENDPOINT string = 'https://${workerContainerApp.outputs.fqdn}'
 output WEB_ENDPOINT string = 'https://${webContainerApp.outputs.fqdn}'
 
 // Resource outputs
@@ -687,7 +528,6 @@ output COSMOS_DB_ENDPOINT string = cosmos.outputs.cosmosEndpoint
 output COSMOS_DB_NAME string = cosmosDbName
 output STORAGE_ACCOUNT_NAME string = storage.outputs.name
 output STORAGE_QUEUE_URL string = storage.outputs.primaryQueueEndpoint
-// WORKER DISABLED: output STORAGE_QUEUE_NAME string = workerQueueName
 output APP_CONFIG_ENDPOINT string = appConfigStore.outputs.endpoint
 output APPLICATIONINSIGHTS_CONNECTION_STRING string = appInsightsConnectionString
 
diff --git a/infra/bicep/main.json b/infra/bicep/main.json
deleted file mode 100644
index b5045cb..0000000
--- a/infra/bicep/main.json
+++ /dev/null
@@ -1,51165 +0,0 @@
-{
-  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-  "languageVersion": "2.0",
-  "contentVersion": "1.0.0.0",
-  "metadata": {
-    "_generator": {
-      "name": "bicep",
-      "version": "0.43.8.12551",
-      "templateHash": "17497183521137074818"
-    }
-  },
-  "parameters": {
-    "deploymentMode": {
-      "type": "string",
-      "allowedValues": [
-        "basic",
-        "ailz-integrated"
-      ],
-      "metadata": {
-        "description": "Deployment mode: basic (creates all networking) or ailz-integrated (uses existing AI Landing Zone)"
-      }
-    },
-    "environmentName": {
-      "type": "string",
-      "minLength": 1,
-      "maxLength": 64,
-      "metadata": {
-        "description": "Name of the environment that can be used as part of naming resource convention"
-      }
-    },
-    "location": {
-      "type": "string",
-      "defaultValue": "[resourceGroup().location]",
-      "minLength": 1,
-      "metadata": {
-        "description": "Primary location for all resources, defaults to resource group location"
-      }
-    },
-    "foundryLocation": {
-      "type": "string",
-      "metadata": {
-        "description": "Location for AI Foundry resources"
-      }
-    },
-    "cosmosLocation": {
-      "type": "string",
-      "defaultValue": "[parameters('location')]",
-      "metadata": {
-        "description": "Location for Cosmos DB resources (override if primary region has capacity issues)"
-      }
-    },
-    "existingOpenAIResourceId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of an existing Azure OpenAI resource for RBAC assignment (if not using AI Foundry integrated endpoint)"
-      }
-    },
-    "principalId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "ID of the user running the deployment"
-      }
-    },
-    "existingVnetResourceId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing AI Landing Zone Virtual Network (required for ailz-integrated mode)"
-      }
-    },
-    "privateEndpointSubnetName": {
-      "type": "string",
-      "defaultValue": "pe-subnet",
-      "metadata": {
-        "description": "Name of the subnet for private endpoints in AI Landing Zone VNet (default: pe-subnet)"
-      }
-    },
-    "containerAppsSubnetName": {
-      "type": "string",
-      "defaultValue": "aca-env-subnet",
-      "metadata": {
-        "description": "Name of the subnet for container apps in AI Landing Zone VNet (default: aca-env-subnet)"
-      }
-    },
-    "existingCognitiveServicesPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Cognitive Services Private DNS Zone (required for ailz-integrated mode)"
-      }
-    },
-    "existingBlobPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Blob Storage Private DNS Zone (required for ailz-integrated mode)"
-      }
-    },
-    "existingQueuePrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Queue Storage Private DNS Zone (optional for ailz-integrated mode)"
-      }
-    },
-    "existingCosmosPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Cosmos DB Private DNS Zone (required for ailz-integrated mode)"
-      }
-    },
-    "existingAppConfigPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing App Config Private DNS Zone (required for ailz-integrated mode)"
-      }
-    },
-    "existingAcrPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Container Registry Private DNS Zone (required for ailz-integrated mode)"
-      }
-    },
-    "existingContainerAppsEnvPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Container Apps Environment Private DNS Zone (required for ailz-integrated mode)"
-      }
-    },
-    "existingKeyVaultPrivateDnsZoneId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Key Vault Private DNS Zone (optional)"
-      }
-    },
-    "existingLogAnalyticsWorkspaceId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing Log Analytics Workspace from AI Landing Zone (optional, will create new if not provided)"
-      }
-    },
-    "existingAppInsightsId": {
-      "type": "string",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Resource ID of existing App Insights from AI Landing Zone (optional, will create new if not provided)"
-      }
-    },
-    "cosmosDbName": {
-      "type": "string",
-      "defaultValue": "contentflow",
-      "metadata": {
-        "description": "Cosmos DB database name"
-      }
-    },
-    "cosmosDBContainerNames": {
-      "type": "array",
-      "defaultValue": [
-        {
-          "name": "executor_catalog",
-          "partitionKey": "/id"
-        },
-        {
-          "name": "pipelines",
-          "partitionKey": "/id"
-        },
-        {
-          "name": "vaults",
-          "partitionKey": "/id"
-        },
-        {
-          "name": "pipeline_executions",
-          "partitionKey": "/id"
-        },
-        {
-          "name": "vault_exec_locks",
-          "partitionKey": "/id"
-        },
-        {
-          "name": "vault_crawl_checkpoints",
-          "partitionKey": "/id"
-        },
-        {
-          "name": "vault_executions",
-          "partitionKey": "/id"
-        }
-      ],
-      "metadata": {
-        "description": "Cosmos DB container names to create"
-      }
-    },
-    "docsContainerName": {
-      "type": "string",
-      "defaultValue": "content",
-      "metadata": {
-        "description": "Name of the blob storage container for documents"
-      }
-    },
-    "apiContainerAppTargetPort": {
-      "type": "int",
-      "defaultValue": 8090,
-      "metadata": {
-        "description": "API Container App target port"
-      }
-    },
-    "workerContainerAppTargetPort": {
-      "type": "int",
-      "defaultValue": 8099,
-      "metadata": {
-        "description": "Worker Container App target port"
-      }
-    },
-    "workerAPIEnabled": {
-      "type": "bool",
-      "defaultValue": true,
-      "metadata": {
-        "description": "Enable API service in worker container app - used for health checks"
-      }
-    },
-    "workerQueueName": {
-      "type": "string",
-      "defaultValue": "contentflow-execution-requests",
-      "metadata": {
-        "description": "Queue name for worker tasks"
-      }
-    }
-  },
-  "variables": {
-    "isBasic": "[equals(parameters('deploymentMode'), 'basic')]",
-    "isAILZIntegrated": "[equals(parameters('deploymentMode'), 'ailz-integrated')]",
-    "ailzValidation": "[if(variables('isAILZIntegrated'), createObject('vnetRequired', coalesce(not(empty(parameters('existingVnetResourceId'))), fail('existingVnetResourceId is required for ailz-integrated mode')), 'peSubnetRequired', coalesce(not(empty(parameters('privateEndpointSubnetName'))), fail('privateEndpointSubnetName is required for ailz-integrated mode')), 'caSubnetRequired', coalesce(not(empty(parameters('containerAppsSubnetName'))), fail('containerAppsSubnetName is required for ailz-integrated mode')), 'cognitiveServicesPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingCognitiveServicesPrivateDnsZoneId'))), fail('existingCognitiveServicesPrivateDnsZoneId is required for ailz-integrated mode')), 'blobPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingBlobPrivateDnsZoneId'))), fail('existingBlobPrivateDnsZoneId is required for ailz-integrated mode')), 'cosmosPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingCosmosPrivateDnsZoneId'))), fail('existingCosmosPrivateDnsZoneId is required for ailz-integrated mode')), 'appConfigPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingAppConfigPrivateDnsZoneId'))), fail('existingAppConfigPrivateDnsZoneId is required for ailz-integrated mode')), 'acrPrivateDnsZoneRequired', coalesce(not(empty(parameters('existingAcrPrivateDnsZoneId'))), fail('existingAcrPrivateDnsZoneId is required for ailz-integrated mode'))), createObject())]",
-    "tags": {
-      "azd-env-name": "[parameters('environmentName')]",
-      "application": "contentflow",
-      "deploymentMode": "[parameters('deploymentMode')]"
-    },
-    "resourceToken": "[uniqueString(resourceGroup().id, parameters('environmentName'), parameters('location'))]",
-    "networkConfig": "[if(variables('isAILZIntegrated'), createObject('enablePrivateEndpoints', true(), 'publicNetworkAccess', 'Disabled', 'vnetResourceId', parameters('existingVnetResourceId'), 'privateEndpointSubnetId', format('{0}/subnets/{1}', parameters('existingVnetResourceId'), parameters('privateEndpointSubnetName')), 'containerAppsSubnetId', format('{0}/subnets/{1}', parameters('existingVnetResourceId'), parameters('containerAppsSubnetName')), 'privateDnsZoneIds', createObject('cognitiveServices', parameters('existingCognitiveServicesPrivateDnsZoneId'), 'blob', parameters('existingBlobPrivateDnsZoneId'), 'queue', parameters('existingQueuePrivateDnsZoneId'), 'cosmos', parameters('existingCosmosPrivateDnsZoneId'), 'appConfig', parameters('existingAppConfigPrivateDnsZoneId'), 'acr', parameters('existingAcrPrivateDnsZoneId'), 'keyVault', parameters('existingKeyVaultPrivateDnsZoneId'), 'containerAppsEnv', parameters('existingContainerAppsEnvPrivateDnsZoneId'))), createObject('enablePrivateEndpoints', false(), 'publicNetworkAccess', 'Enabled'))]",
-    "userAssignedIdentityName": "[format('id-{0}', variables('resourceToken'))]",
-    "logAnalyticsWorkspaceName": "[format('log-{0}', variables('resourceToken'))]",
-    "appInsightsName": "[format('appi-{0}', variables('resourceToken'))]",
-    "storageAccountName": "[take(format('st{0}', variables('resourceToken')), 24)]",
-    "cosmosAccountName": "[format('cosmos-{0}', variables('resourceToken'))]",
-    "appConfigStoreName": "[format('appcs-{0}', variables('resourceToken'))]",
-    "containerRegistryName": "[format('cr{0}', variables('resourceToken'))]",
-    "containerAppsEnvironmentName": "[format('cae-{0}', variables('resourceToken'))]",
-    "apiContainerAppName": "[format('api-{0}', variables('resourceToken'))]",
-    "workerContainerAppName": "[format('worker-{0}', variables('resourceToken'))]",
-    "webContainerAppName": "[format('web-{0}', variables('resourceToken'))]",
-    "shouldCreateLogAnalytics": "[and(variables('isBasic'), empty(parameters('existingLogAnalyticsWorkspaceId')))]",
-    "shouldCreateAppInsights": "[and(variables('isBasic'), empty(parameters('existingAppInsightsId')))]",
-    "shouldCreateQueueDnsZone": "[and(variables('isAILZIntegrated'), empty(parameters('existingQueuePrivateDnsZoneId')))]"
-  },
-  "resources": {
-    "userAssignedIdentity": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('userAssignedIdentity-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "userAssignedIdentityName": {
-            "value": "[variables('userAssignedIdentityName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "1061071107834451110"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional: Location for all resources. Default is the resource group location"
-              }
-            },
-            "userAssignedIdentityName": {
-              "type": "string",
-              "metadata": {
-                "description": "Required: User Assigned Identity name"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional: Tags for resources"
-              }
-            }
-          },
-          "resources": {
-            "userAssignedIdentity": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('userAssignedIdentity-{0}', uniqueString('userAssignedIdentity', deployment().name))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('userAssignedIdentityName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.34.44.8038",
-                      "templateHash": "16707109626832623586"
-                    },
-                    "name": "User Assigned Identities",
-                    "description": "This module deploys a User Assigned Identity."
-                  },
-                  "definitions": {
-                    "federatedIdentityCredentialType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the federated identity credential."
-                          }
-                        },
-                        "audiences": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. The list of audiences that can appear in the issued token."
-                          }
-                        },
-                        "issuer": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The URL of the issuer to be trusted."
-                          }
-                        },
-                        "subject": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The identifier of the external identity."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the federated identity credential."
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the User Assigned Identity."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "federatedIdentityCredentials": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/federatedIdentityCredentialType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The federated identity credentials list to indicate which token from the external IdP should be trusted by your application. Federated identity credentials are supported on applications only. A maximum of 20 federated identity credentials can be added per application object."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Managed Identity Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e40ec5ca-96e0-45a2-b4ff-59039f2c2b59')]",
-                      "Managed Identity Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f1a07417-d97a-45cb-824c-7a7467783830')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.managedidentity-userassignedidentity.{0}.{1}', replace('0.4.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "userAssignedIdentity": {
-                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-                      "apiVersion": "2024-11-30",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]"
-                    },
-                    "userAssignedIdentity_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "userAssignedIdentity"
-                      ]
-                    },
-                    "userAssignedIdentity_roleAssignments": {
-                      "copy": {
-                        "name": "userAssignedIdentity_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.ManagedIdentity/userAssignedIdentities/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "userAssignedIdentity"
-                      ]
-                    },
-                    "userAssignedIdentity_federatedIdentityCredentials": {
-                      "copy": {
-                        "name": "userAssignedIdentity_federatedIdentityCredentials",
-                        "count": "[length(coalesce(parameters('federatedIdentityCredentials'), createArray()))]",
-                        "mode": "serial",
-                        "batchSize": 1
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-UserMSI-FederatedIdentityCred-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].name]"
-                          },
-                          "userAssignedIdentityName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "audiences": {
-                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].audiences]"
-                          },
-                          "issuer": {
-                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].issuer]"
-                          },
-                          "subject": {
-                            "value": "[coalesce(parameters('federatedIdentityCredentials'), createArray())[copyIndex()].subject]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "13656021764446440473"
-                            },
-                            "name": "User Assigned Identity Federated Identity Credential",
-                            "description": "This module deploys a User Assigned Identity Federated Identity Credential."
-                          },
-                          "parameters": {
-                            "userAssignedIdentityName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent user assigned identity. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the secret."
-                              }
-                            },
-                            "audiences": {
-                              "type": "array",
-                              "metadata": {
-                                "description": "Required. The list of audiences that can appear in the issued token. Should be set to api://AzureADTokenExchange for Azure AD. It says what Microsoft identity platform should accept in the aud claim in the incoming token. This value represents Azure AD in your external identity provider and has no fixed value across identity providers - you might need to create a new application registration in your IdP to serve as the audience of this token."
-                              }
-                            },
-                            "issuer": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The URL of the issuer to be trusted. Must match the issuer claim of the external token being exchanged."
-                              }
-                            },
-                            "subject": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The identifier of the external software workload within the external identity provider. Like the audience value, it has no fixed format, as each IdP uses their own - sometimes a GUID, sometimes a colon delimited identifier, sometimes arbitrary strings. The value here must match the sub claim within the token presented to Azure AD."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials",
-                              "apiVersion": "2024-11-30",
-                              "name": "[format('{0}/{1}', parameters('userAssignedIdentityName'), parameters('name'))]",
-                              "properties": {
-                                "audiences": "[parameters('audiences')]",
-                                "issuer": "[parameters('issuer')]",
-                                "subject": "[parameters('subject')]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the federated identity credential."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the federated identity credential."
-                              },
-                              "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials', parameters('userAssignedIdentityName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the federated identity credential was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "userAssignedIdentity"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the user assigned identity."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the user assigned identity."
-                      },
-                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('name'))]"
-                    },
-                    "principalId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The principal ID (object ID) of the user assigned identity."
-                      },
-                      "value": "[reference('userAssignedIdentity').principalId]"
-                    },
-                    "clientId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The client ID (application ID) of the user assigned identity."
-                      },
-                      "value": "[reference('userAssignedIdentity').clientId]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the user assigned identity was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('userAssignedIdentity', '2024-11-30', 'full').location]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "value": "[reference('userAssignedIdentity').outputs.name.value]"
-            },
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
-            },
-            "principalId": {
-              "type": "string",
-              "value": "[reference('userAssignedIdentity').outputs.principalId.value]"
-            },
-            "clientId": {
-              "type": "string",
-              "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
-            }
-          }
-        }
-      }
-    },
-    "logAnalytics": {
-      "condition": "[variables('shouldCreateLogAnalytics')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('logAnalytics-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "logAnalyticsWorkspaceName": {
-            "value": "[variables('logAnalyticsWorkspaceName')]"
-          },
-          "roleAssignedManagedIdentityPrincipalIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.principalId.value]"
-            ]
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "220699877648959996"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Location for all resources"
-              }
-            },
-            "logAnalyticsWorkspaceName": {
-              "type": "string",
-              "metadata": {
-                "description": "Log Analytics workspace name"
-              }
-            },
-            "roleAssignedManagedIdentityPrincipalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "metadata": {
-                "description": "User Assigned Identity that be given access to the Log Analytics Workspace"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "resources": {
-            "logAnalytics": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('logAnalytics-{0}', uniqueString('logAnalytics', deployment().name))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('logAnalyticsWorkspaceName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "skuName": {
-                    "value": "PerGB2018"
-                  },
-                  "dataRetention": {
-                    "value": 30
-                  },
-                  "roleAssignments": {
-                    "copy": [
-                      {
-                        "name": "value",
-                        "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                        "input": "[createObject('principalId', parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('value')], 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Log Analytics Contributor')]"
-                      }
-                    ]
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.36.1.42791",
-                      "templateHash": "1749032521457140145"
-                    },
-                    "name": "Log Analytics Workspaces",
-                    "description": "This module deploys a Log Analytics Workspace."
-                  },
-                  "definitions": {
-                    "diagnosticSettingType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "useThisWorkspace": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Instead of using an external reference, use the deployed instance as the target for its diagnostic settings. If set to `true`, the `workspaceResourceId` property is ignored."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      }
-                    },
-                    "gallerySolutionType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
-                          }
-                        },
-                        "plan": {
-                          "$ref": "#/definitions/solutionPlanType",
-                          "metadata": {
-                            "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the gallery solutions to be created in the log analytics workspace."
-                      }
-                    },
-                    "storageInsightsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the storage account to be linked."
-                          }
-                        },
-                        "containers": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The names of the blob containers that the workspace should read."
-                          }
-                        },
-                        "tables": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. List of tables to be read by the workspace."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the storage insights configuration."
-                      }
-                    },
-                    "linkedServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the linked service."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
-                          }
-                        },
-                        "writeAccessResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource id of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the linked service."
-                      }
-                    },
-                    "linkedStorageAccountType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the link."
-                          }
-                        },
-                        "storageAccountIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "minLength": 1,
-                          "metadata": {
-                            "description": "Required. Linked storage accounts resources Ids."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the linked storage account."
-                      }
-                    },
-                    "savedSearchType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the saved search."
-                          }
-                        },
-                        "etag": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
-                          }
-                        },
-                        "category": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The category of the saved search. This helps the user to find a saved search faster."
-                          }
-                        },
-                        "displayName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Display name for the search."
-                          }
-                        },
-                        "functionAlias": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The function alias if query serves as a function."
-                          }
-                        },
-                        "functionParameters": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: 'param-name1:type1 = default_value1, param-name2:type2 = default_value2'. For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
-                          }
-                        },
-                        "query": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The query expression for the saved search."
-                          }
-                        },
-                        "tags": {
-                          "type": "array",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The tags attached to the saved search."
-                          }
-                        },
-                        "version": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version number of the query language. The current version is 2 and is the default."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the saved search."
-                      }
-                    },
-                    "dataExportType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the data export."
-                          }
-                        },
-                        "destination": {
-                          "$ref": "#/definitions/destinationType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The destination of the data export."
-                          }
-                        },
-                        "enable": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable the data export."
-                          }
-                        },
-                        "tableNames": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. The list of table names to export."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the data export."
-                      }
-                    },
-                    "dataSourceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the data source."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The kind of data source."
-                          }
-                        },
-                        "linkedResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource id of the resource that will be linked to the workspace."
-                          }
-                        },
-                        "eventLogName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the event log to configure when kind is WindowsEvent."
-                          }
-                        },
-                        "eventTypes": {
-                          "type": "array",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The event types to configure when kind is WindowsEvent."
-                          }
-                        },
-                        "objectName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                          }
-                        },
-                        "instanceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                          }
-                        },
-                        "intervalSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                          }
-                        },
-                        "performanceCounters": {
-                          "type": "array",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
-                          }
-                        },
-                        "counterName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
-                          }
-                        },
-                        "state": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
-                          }
-                        },
-                        "syslogName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. System log to configure when kind is LinuxSyslog."
-                          }
-                        },
-                        "syslogSeverities": {
-                          "type": "array",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Severities to configure when kind is LinuxSyslog."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags"
-                            },
-                            "description": "Optional. Tags to configure in the resource."
-                          },
-                          "nullable": true
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the data source."
-                      }
-                    },
-                    "tableType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the table."
-                          }
-                        },
-                        "plan": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The plan for the table."
-                          }
-                        },
-                        "restoredLogs": {
-                          "$ref": "#/definitions/restoredLogsType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The restored logs for the table."
-                          }
-                        },
-                        "schema": {
-                          "$ref": "#/definitions/schemaType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The schema for the table."
-                          }
-                        },
-                        "searchResults": {
-                          "$ref": "#/definitions/searchResultsType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The search results for the table."
-                          }
-                        },
-                        "retentionInDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The retention in days for the table."
-                          }
-                        },
-                        "totalRetentionInDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The total retention in days for the table."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The role assignments for the table."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Properties of the custom table."
-                      }
-                    },
-                    "workspaceFeaturesType": {
-                      "type": "object",
-                      "properties": {
-                        "disableLocalAuth": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Disable Non-EntraID based Auth. Default is true."
-                          }
-                        },
-                        "enableDataExport": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Flag that indicate if data should be exported."
-                          }
-                        },
-                        "enableLogAccessUsingOnlyResourcePermissions": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable log access using only resource permissions. Default is false."
-                          }
-                        },
-                        "immediatePurgeDataOn30Days": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Flag that describes if we want to remove the data after 30 days."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Features of the workspace."
-                      }
-                    },
-                    "workspaceReplicationType": {
-                      "type": "object",
-                      "properties": {
-                        "enabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies whether the replication is enabled or not. When true, workspace configuration and data is replicated to the specified location."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The location to which the workspace is replicated. Required if replication is enabled."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Replication properties of the workspace."
-                      }
-                    },
-                    "_1.columnType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The column name."
-                          }
-                        },
-                        "type": {
-                          "type": "string",
-                          "allowedValues": [
-                            "boolean",
-                            "dateTime",
-                            "dynamic",
-                            "guid",
-                            "int",
-                            "long",
-                            "real",
-                            "string"
-                          ],
-                          "metadata": {
-                            "description": "Required. The column type."
-                          }
-                        },
-                        "dataTypeHint": {
-                          "type": "string",
-                          "allowedValues": [
-                            "armPath",
-                            "guid",
-                            "ip",
-                            "uri"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The column data type logical hint."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The column description."
-                          }
-                        },
-                        "displayName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Column display name."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The parameters of the table column.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "table/main.bicep"
-                        }
-                      }
-                    },
-                    "destinationType": {
-                      "type": "object",
-                      "properties": {
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The destination resource ID."
-                          }
-                        },
-                        "metaData": {
-                          "type": "object",
-                          "properties": {
-                            "eventHubName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The destination metadata."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The data export destination properties.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "data-export/main.bicep"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "restoredLogsType": {
-                      "type": "object",
-                      "properties": {
-                        "sourceTable": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The table to restore data from."
-                          }
-                        },
-                        "startRestoreTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to start the restore from (UTC)."
-                          }
-                        },
-                        "endRestoreTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to end the restore by (UTC)."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The parameters of the restore operation that initiated the table.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "table/main.bicep"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "schemaType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The table name."
-                          }
-                        },
-                        "columns": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.columnType"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of table custom columns."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The table description."
-                          }
-                        },
-                        "displayName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The table display name."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The table schema.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "table/main.bicep"
-                        }
-                      }
-                    },
-                    "searchResultsType": {
-                      "type": "object",
-                      "properties": {
-                        "query": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The search job query."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The search description."
-                          }
-                        },
-                        "limit": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Limit the search job to return up to specified number of rows."
-                          }
-                        },
-                        "startSearchTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to start the search from (UTC)."
-                          }
-                        },
-                        "endSearchTime": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The timestamp to end the search by (UTC)."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The parameters of the search job that initiated the table.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "table/main.bicep"
-                        }
-                      }
-                    },
-                    "solutionPlanType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
-                          }
-                        },
-                        "product": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
-                          }
-                        },
-                        "publisher": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/operations-management/solution:0.3.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Log Analytics workspace."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "skuName": {
-                      "type": "string",
-                      "defaultValue": "PerGB2018",
-                      "allowedValues": [
-                        "CapacityReservation",
-                        "Free",
-                        "LACluster",
-                        "PerGB2018",
-                        "PerNode",
-                        "Premium",
-                        "Standalone",
-                        "Standard"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The name of the SKU."
-                      }
-                    },
-                    "skuCapacityReservationLevel": {
-                      "type": "int",
-                      "defaultValue": 100,
-                      "minValue": 100,
-                      "maxValue": 5000,
-                      "metadata": {
-                        "description": "Optional. The capacity reservation level in GB for this workspace, when CapacityReservation sku is selected. Must be in increments of 100 between 100 and 5000."
-                      }
-                    },
-                    "storageInsightsConfigs": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/storageInsightsConfigType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. List of storage accounts to be read by the workspace."
-                      }
-                    },
-                    "linkedServices": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/linkedServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. List of services to be linked."
-                      }
-                    },
-                    "linkedStorageAccounts": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/linkedStorageAccountType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. List of Storage Accounts to be linked. Required if 'forceCmkForQuery' is set to 'true' and 'savedSearches' is not empty."
-                      }
-                    },
-                    "savedSearches": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/savedSearchType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Kusto Query Language searches to save."
-                      }
-                    },
-                    "dataExports": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/dataExportType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. LAW data export instances to be deployed."
-                      }
-                    },
-                    "dataSources": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/dataSourceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. LAW data sources to configure."
-                      }
-                    },
-                    "tables": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/tableType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. LAW custom tables to be deployed."
-                      }
-                    },
-                    "gallerySolutions": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/gallerySolutionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. List of gallerySolutions to be created in the log analytics workspace."
-                      }
-                    },
-                    "onboardWorkspaceToSentinel": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Onboard the Log Analytics Workspace to Sentinel. Requires 'SecurityInsights' solution to be in gallerySolutions."
-                      }
-                    },
-                    "dataRetention": {
-                      "type": "int",
-                      "defaultValue": 365,
-                      "minValue": 0,
-                      "maxValue": 730,
-                      "metadata": {
-                        "description": "Optional. Number of days data will be retained for."
-                      }
-                    },
-                    "dailyQuotaGb": {
-                      "type": "int",
-                      "defaultValue": -1,
-                      "minValue": -1,
-                      "metadata": {
-                        "description": "Optional. The workspace daily quota for ingestion."
-                      }
-                    },
-                    "publicNetworkAccessForIngestion": {
-                      "type": "string",
-                      "defaultValue": "Enabled",
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The network access type for accessing Log Analytics ingestion."
-                      }
-                    },
-                    "publicNetworkAccessForQuery": {
-                      "type": "string",
-                      "defaultValue": "Enabled",
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The network access type for accessing Log Analytics query."
-                      }
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource. Only one type of identity is supported: system-assigned or user-assigned, but not both."
-                      }
-                    },
-                    "features": {
-                      "$ref": "#/definitions/workspaceFeaturesType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The workspace features."
-                      }
-                    },
-                    "replication": {
-                      "$ref": "#/definitions/workspaceReplicationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The workspace replication properties."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "forceCmkForQuery": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Indicates whether customer managed storage is mandatory for query management."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.OperationalInsights/workspaces@2025-02-01#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "enableReferencedModulesTelemetry": false,
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
-                      "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
-                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
-                      "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "Security Admin": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fb1c8493-542b-48eb-b624-b4c8fea62acd')]",
-                      "Security Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '39bc4728-0917-49c7-9d2c-d95423bc2eb4')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.operationalinsights-workspace.{0}.{1}', replace('0.12.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "logAnalyticsWorkspace": {
-                      "type": "Microsoft.OperationalInsights/workspaces",
-                      "apiVersion": "2025-02-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": {
-                        "features": {
-                          "searchVersion": 1,
-                          "enableLogAccessUsingOnlyResourcePermissions": "[coalesce(tryGet(parameters('features'), 'enableLogAccessUsingOnlyResourcePermissions'), false())]",
-                          "disableLocalAuth": "[coalesce(tryGet(parameters('features'), 'disableLocalAuth'), true())]",
-                          "enableDataExport": "[tryGet(parameters('features'), 'enableDataExport')]",
-                          "immediatePurgeDataOn30Days": "[tryGet(parameters('features'), 'immediatePurgeDataOn30Days')]"
-                        },
-                        "sku": {
-                          "name": "[parameters('skuName')]",
-                          "capacityReservationLevel": "[if(equals(parameters('skuName'), 'CapacityReservation'), parameters('skuCapacityReservationLevel'), null())]"
-                        },
-                        "retentionInDays": "[parameters('dataRetention')]",
-                        "workspaceCapping": {
-                          "dailyQuotaGb": "[parameters('dailyQuotaGb')]"
-                        },
-                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
-                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
-                        "forceCmkForQuery": "[parameters('forceCmkForQuery')]",
-                        "replication": "[parameters('replication')]"
-                      },
-                      "identity": "[variables('identity')]"
-                    },
-                    "logAnalyticsWorkspace_diagnosticSettings": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[if(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'useThisWorkspace'), false()), resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId'))]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_sentinelOnboarding": {
-                      "condition": "[and(not(empty(filter(coalesce(parameters('gallerySolutions'), createArray()), lambda('item', startsWith(lambdaVariables('item').name, 'SecurityInsights'))))), parameters('onboardWorkspaceToSentinel'))]",
-                      "type": "Microsoft.SecurityInsights/onboardingStates",
-                      "apiVersion": "2024-03-01",
-                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-                      "name": "default",
-                      "properties": {},
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_roleAssignments": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_storageInsightConfigs": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_storageInsightConfigs",
-                        "count": "[length(coalesce(parameters('storageInsightsConfigs'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-StorageInsightsConfig-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "logAnalyticsWorkspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "containers": {
-                            "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'containers')]"
-                          },
-                          "tables": {
-                            "value": "[tryGet(coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()], 'tables')]"
-                          },
-                          "storageAccountResourceId": {
-                            "value": "[coalesce(parameters('storageInsightsConfigs'), createArray())[copyIndex()].storageAccountResourceId]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "1306323182548882150"
-                            },
-                            "name": "Log Analytics Workspace Storage Insight Configs",
-                            "description": "This module deploys a Log Analytics Workspace Storage Insight Config."
-                          },
-                          "parameters": {
-                            "logAnalyticsWorkspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "[format('{0}-stinsconfig', last(split(parameters('storageAccountResourceId'), '/')))]",
-                              "metadata": {
-                                "description": "Optional. The name of the storage insights config."
-                              }
-                            },
-                            "storageAccountResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The Azure Resource Manager ID of the storage account resource."
-                              }
-                            },
-                            "containers": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The names of the blob containers that the workspace should read."
-                              }
-                            },
-                            "tables": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The names of the Azure tables that the workspace should read."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs@2025-02-01#properties/tags"
-                                },
-                                "description": "Optional. Tags to configure in the resource."
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "resources": {
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2024-01-01",
-                              "name": "[last(split(parameters('storageAccountResourceId'), '/'))]"
-                            },
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('logAnalyticsWorkspaceName')]"
-                            },
-                            "storageinsightconfig": {
-                              "type": "Microsoft.OperationalInsights/workspaces/storageInsightConfigs",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "containers": "[parameters('containers')]",
-                                "tables": "[parameters('tables')]",
-                                "storageAccount": {
-                                  "id": "[parameters('storageAccountResourceId')]",
-                                  "key": "[listKeys('storageAccount', '2024-01-01').keys[0].value]"
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed storage insights configuration."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/storageInsightConfigs', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group where the storage insight configuration is deployed."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the storage insights configuration."
-                              },
-                              "value": "[parameters('name')]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_linkedServices": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_linkedServices",
-                        "count": "[length(coalesce(parameters('linkedServices'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-LinkedService-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "logAnalyticsWorkspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('linkedServices'), createArray())[copyIndex()].name]"
-                          },
-                          "resourceId": {
-                            "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'resourceId')]"
-                          },
-                          "writeAccessResourceId": {
-                            "value": "[tryGet(coalesce(parameters('linkedServices'), createArray())[copyIndex()], 'writeAccessResourceId')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "5230241501765697269"
-                            },
-                            "name": "Log Analytics Workspace Linked Services",
-                            "description": "This module deploys a Log Analytics Workspace Linked Service."
-                          },
-                          "parameters": {
-                            "logAnalyticsWorkspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the link."
-                              }
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require read access."
-                              }
-                            },
-                            "writeAccessResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the resource that will be linked to the workspace. This should be used for linking resources which require write access."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.OperationalInsights/workspaces/linkedServices@2025-02-01#properties/tags"
-                                },
-                                "description": "Optional. Tags to configure in the resource."
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "resources": {
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('logAnalyticsWorkspaceName')]"
-                            },
-                            "linkedService": {
-                              "type": "Microsoft.OperationalInsights/workspaces/linkedServices",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "resourceId": "[parameters('resourceId')]",
-                                "writeAccessResourceId": "[parameters('writeAccessResourceId')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed linked service."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed linked service."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedServices', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group where the linked service is deployed."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_linkedStorageAccounts": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_linkedStorageAccounts",
-                        "count": "[length(coalesce(parameters('linkedStorageAccounts'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-LinkedStorageAccount-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "logAnalyticsWorkspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].name]"
-                          },
-                          "storageAccountIds": {
-                            "value": "[coalesce(parameters('linkedStorageAccounts'), createArray())[copyIndex()].storageAccountIds]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "10372135754202496594"
-                            },
-                            "name": "Log Analytics Workspace Linked Storage Accounts",
-                            "description": "This module deploys a Log Analytics Workspace Linked Storage Account."
-                          },
-                          "parameters": {
-                            "logAnalyticsWorkspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "allowedValues": [
-                                "Query",
-                                "Alerts",
-                                "CustomLogs",
-                                "AzureWatson"
-                              ],
-                              "metadata": {
-                                "description": "Required. Name of the link."
-                              }
-                            },
-                            "storageAccountIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "minLength": 1,
-                              "metadata": {
-                                "description": "Required. Linked storage accounts resources Ids."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('logAnalyticsWorkspaceName')]"
-                            },
-                            "linkedStorageAccount": {
-                              "type": "Microsoft.OperationalInsights/workspaces/linkedStorageAccounts",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                              "properties": {
-                                "storageAccountIds": "[parameters('storageAccountIds')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed linked storage account."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed linked storage account."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/linkedStorageAccounts', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group where the linked storage account is deployed."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_savedSearches": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_savedSearches",
-                        "count": "[length(coalesce(parameters('savedSearches'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-SavedSearch-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "logAnalyticsWorkspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[format('{0}{1}', coalesce(parameters('savedSearches'), createArray())[copyIndex()].name, uniqueString(deployment().name))]"
-                          },
-                          "etag": {
-                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'etag')]"
-                          },
-                          "displayName": {
-                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].displayName]"
-                          },
-                          "category": {
-                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].category]"
-                          },
-                          "query": {
-                            "value": "[coalesce(parameters('savedSearches'), createArray())[copyIndex()].query]"
-                          },
-                          "functionAlias": {
-                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionAlias')]"
-                          },
-                          "functionParameters": {
-                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'functionParameters')]"
-                          },
-                          "tags": {
-                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'tags')]"
-                          },
-                          "version": {
-                            "value": "[tryGet(coalesce(parameters('savedSearches'), createArray())[copyIndex()], 'version')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "9015459905306126128"
-                            },
-                            "name": "Log Analytics Workspace Saved Searches",
-                            "description": "This module deploys a Log Analytics Workspace Saved Search."
-                          },
-                          "parameters": {
-                            "logAnalyticsWorkspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the saved search."
-                              }
-                            },
-                            "displayName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Display name for the search."
-                              }
-                            },
-                            "category": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Query category."
-                              }
-                            },
-                            "query": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Kusto Query to be stored."
-                              }
-                            },
-                            "tags": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.OperationalInsights/workspaces/savedSearches@2025-02-01#properties/properties/properties/tags"
-                                },
-                                "description": "Optional. Tags to configure in the resource."
-                              },
-                              "nullable": true
-                            },
-                            "functionAlias": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. The function alias if query serves as a function."
-                              }
-                            },
-                            "functionParameters": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. The optional function parameters if query serves as a function. Value should be in the following format: \"param-name1:type1 = default_value1, param-name2:type2 = default_value2\". For more examples and proper syntax please refer to /azure/kusto/query/functions/user-defined-functions."
-                              }
-                            },
-                            "version": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The version number of the query language."
-                              }
-                            },
-                            "etag": {
-                              "type": "string",
-                              "defaultValue": "*",
-                              "metadata": {
-                                "description": "Optional. The ETag of the saved search. To override an existing saved search, use \"*\" or specify the current Etag."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('logAnalyticsWorkspaceName')]"
-                            },
-                            "savedSearch": {
-                              "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                              "properties": {
-                                "etag": "[parameters('etag')]",
-                                "tags": "[coalesce(parameters('tags'), createArray())]",
-                                "displayName": "[parameters('displayName')]",
-                                "category": "[parameters('category')]",
-                                "query": "[parameters('query')]",
-                                "functionAlias": "[parameters('functionAlias')]",
-                                "functionParameters": "[parameters('functionParameters')]",
-                                "version": "[parameters('version')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed saved search."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group where the saved search is deployed."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed saved search."
-                              },
-                              "value": "[parameters('name')]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace",
-                        "logAnalyticsWorkspace_linkedStorageAccounts"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_dataExports": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_dataExports",
-                        "count": "[length(coalesce(parameters('dataExports'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-DataExport-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "workspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('dataExports'), createArray())[copyIndex()].name]"
-                          },
-                          "destination": {
-                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'destination')]"
-                          },
-                          "enable": {
-                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'enable')]"
-                          },
-                          "tableNames": {
-                            "value": "[tryGet(coalesce(parameters('dataExports'), createArray())[copyIndex()], 'tableNames')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "8586520532175356447"
-                            },
-                            "name": "Log Analytics Workspace Data Exports",
-                            "description": "This module deploys a Log Analytics Workspace Data Export."
-                          },
-                          "definitions": {
-                            "destinationType": {
-                              "type": "object",
-                              "properties": {
-                                "resourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The destination resource ID."
-                                  }
-                                },
-                                "metaData": {
-                                  "type": "object",
-                                  "properties": {
-                                    "eventHubName": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Allows to define an Event Hub name. Not applicable when destination is Storage Account."
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The destination metadata."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The data export destination properties."
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "minLength": 4,
-                              "maxLength": 63,
-                              "metadata": {
-                                "description": "Required. The data export rule name."
-                              }
-                            },
-                            "workspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "destination": {
-                              "$ref": "#/definitions/destinationType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Destination properties."
-                              }
-                            },
-                            "enable": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Active when enabled."
-                              }
-                            },
-                            "tableNames": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "minLength": 1,
-                              "metadata": {
-                                "description": "Required. An array of tables to export, for example: ['Heartbeat', 'SecurityEvent']."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('workspaceName')]"
-                            },
-                            "dataExport": {
-                              "type": "Microsoft.OperationalInsights/workspaces/dataExports",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
-                              "properties": {
-                                "destination": "[parameters('destination')]",
-                                "enable": "[parameters('enable')]",
-                                "tableNames": "[parameters('tableNames')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the data export."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the data export."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataExports', parameters('workspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the data export was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_dataSources": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_dataSources",
-                        "count": "[length(coalesce(parameters('dataSources'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-DataSource-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "logAnalyticsWorkspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].name]"
-                          },
-                          "kind": {
-                            "value": "[coalesce(parameters('dataSources'), createArray())[copyIndex()].kind]"
-                          },
-                          "linkedResourceId": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'linkedResourceId')]"
-                          },
-                          "eventLogName": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventLogName')]"
-                          },
-                          "eventTypes": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'eventTypes')]"
-                          },
-                          "objectName": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'objectName')]"
-                          },
-                          "instanceName": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'instanceName')]"
-                          },
-                          "intervalSeconds": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'intervalSeconds')]"
-                          },
-                          "counterName": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'counterName')]"
-                          },
-                          "state": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'state')]"
-                          },
-                          "syslogName": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogName')]"
-                          },
-                          "syslogSeverities": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'syslogSeverities')]"
-                          },
-                          "performanceCounters": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'performanceCounters')]"
-                          },
-                          "tags": {
-                            "value": "[tryGet(coalesce(parameters('dataSources'), createArray())[copyIndex()], 'tags')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "8336916453932906250"
-                            },
-                            "name": "Log Analytics Workspace Datasources",
-                            "description": "This module deploys a Log Analytics Workspace Data Source."
-                          },
-                          "parameters": {
-                            "logAnalyticsWorkspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Log Analytics workspace. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the data source."
-                              }
-                            },
-                            "kind": {
-                              "type": "string",
-                              "defaultValue": "AzureActivityLog",
-                              "allowedValues": [
-                                "AzureActivityLog",
-                                "WindowsEvent",
-                                "WindowsPerformanceCounter",
-                                "IISLogs",
-                                "LinuxSyslog",
-                                "LinuxSyslogCollection",
-                                "LinuxPerformanceObject",
-                                "LinuxPerformanceCollection"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The kind of the data source."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.OperationalInsights/workspaces/dataSources@2025-02-01#properties/tags"
-                                },
-                                "description": "Optional. Tags to configure in the resource."
-                              },
-                              "nullable": true
-                            },
-                            "linkedResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource ID of the resource to be linked."
-                              }
-                            },
-                            "eventLogName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Windows event log name to configure when kind is WindowsEvent."
-                              }
-                            },
-                            "eventTypes": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. Windows event types to configure when kind is WindowsEvent."
-                              }
-                            },
-                            "objectName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Name of the object to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                              }
-                            },
-                            "instanceName": {
-                              "type": "string",
-                              "defaultValue": "*",
-                              "metadata": {
-                                "description": "Optional. Name of the instance to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                              }
-                            },
-                            "intervalSeconds": {
-                              "type": "int",
-                              "defaultValue": 60,
-                              "metadata": {
-                                "description": "Optional. Interval in seconds to configure when kind is WindowsPerformanceCounter or LinuxPerformanceObject."
-                              }
-                            },
-                            "performanceCounters": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. List of counters to configure when the kind is LinuxPerformanceObject."
-                              }
-                            },
-                            "counterName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Counter name to configure when kind is WindowsPerformanceCounter."
-                              }
-                            },
-                            "state": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. State to configure when kind is IISLogs or LinuxSyslogCollection or LinuxPerformanceCollection."
-                              }
-                            },
-                            "syslogName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. System log to configure when kind is LinuxSyslog."
-                              }
-                            },
-                            "syslogSeverities": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. Severities to configure when kind is LinuxSyslog."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('logAnalyticsWorkspaceName')]"
-                            },
-                            "dataSource": {
-                              "type": "Microsoft.OperationalInsights/workspaces/dataSources",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('logAnalyticsWorkspaceName'), parameters('name'))]",
-                              "kind": "[parameters('kind')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "linkedResourceId": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'AzureActivityLog')), parameters('linkedResourceId'), null())]",
-                                "eventLogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventLogName'), null())]",
-                                "eventTypes": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsEvent')), parameters('eventTypes'), null())]",
-                                "objectName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('objectName'), null())]",
-                                "instanceName": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('instanceName'), null())]",
-                                "intervalSeconds": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'WindowsPerformanceCounter'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('intervalSeconds'), null())]",
-                                "counterName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'WindowsPerformanceCounter')), parameters('counterName'), null())]",
-                                "state": "[if(and(not(empty(parameters('kind'))), or(or(equals(parameters('kind'), 'IISLogs'), equals(parameters('kind'), 'LinuxSyslogCollection')), equals(parameters('kind'), 'LinuxPerformanceCollection'))), parameters('state'), null())]",
-                                "syslogName": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxSyslog')), parameters('syslogName'), null())]",
-                                "syslogSeverities": "[if(and(not(empty(parameters('kind'))), or(equals(parameters('kind'), 'LinuxSyslog'), equals(parameters('kind'), 'LinuxPerformanceObject'))), parameters('syslogSeverities'), null())]",
-                                "performanceCounters": "[if(and(not(empty(parameters('kind'))), equals(parameters('kind'), 'LinuxPerformanceObject')), parameters('performanceCounters'), null())]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed data source."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/dataSources', parameters('logAnalyticsWorkspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group where the data source is deployed."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed data source."
-                              },
-                              "value": "[parameters('name')]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_tables": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_tables",
-                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-Table-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "workspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
-                          },
-                          "plan": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'plan')]"
-                          },
-                          "schema": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'schema')]"
-                          },
-                          "retentionInDays": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'retentionInDays')]"
-                          },
-                          "totalRetentionInDays": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'totalRetentionInDays')]"
-                          },
-                          "restoredLogs": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'restoredLogs')]"
-                          },
-                          "searchResults": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'searchResults')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'roleAssignments')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.36.1.42791",
-                              "templateHash": "315390662258960765"
-                            },
-                            "name": "Log Analytics Workspace Tables",
-                            "description": "This module deploys a Log Analytics Workspace Table."
-                          },
-                          "definitions": {
-                            "restoredLogsType": {
-                              "type": "object",
-                              "properties": {
-                                "sourceTable": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The table to restore data from."
-                                  }
-                                },
-                                "startRestoreTime": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The timestamp to start the restore from (UTC)."
-                                  }
-                                },
-                                "endRestoreTime": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The timestamp to end the restore by (UTC)."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The parameters of the restore operation that initiated the table."
-                              }
-                            },
-                            "schemaType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The table name."
-                                  }
-                                },
-                                "columns": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/columnType"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of table custom columns."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The table description."
-                                  }
-                                },
-                                "displayName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The table display name."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The table schema."
-                              }
-                            },
-                            "columnType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The column name."
-                                  }
-                                },
-                                "type": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "boolean",
-                                    "dateTime",
-                                    "dynamic",
-                                    "guid",
-                                    "int",
-                                    "long",
-                                    "real",
-                                    "string"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. The column type."
-                                  }
-                                },
-                                "dataTypeHint": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "armPath",
-                                    "guid",
-                                    "ip",
-                                    "uri"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The column data type logical hint."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The column description."
-                                  }
-                                },
-                                "displayName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Column display name."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The parameters of the table column."
-                              }
-                            },
-                            "searchResultsType": {
-                              "type": "object",
-                              "properties": {
-                                "query": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The search job query."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The search description."
-                                  }
-                                },
-                                "limit": {
-                                  "type": "int",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Limit the search job to return up to specified number of rows."
-                                  }
-                                },
-                                "startSearchTime": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The timestamp to start the search from (UTC)."
-                                  }
-                                },
-                                "endSearchTime": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The timestamp to end the search by (UTC)."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The parameters of the search job that initiated the table."
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the table."
-                              }
-                            },
-                            "workspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent workspaces. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "plan": {
-                              "type": "string",
-                              "defaultValue": "Analytics",
-                              "allowedValues": [
-                                "Basic",
-                                "Analytics"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Instruct the system how to handle and charge the logs ingested to this table."
-                              }
-                            },
-                            "restoredLogs": {
-                              "$ref": "#/definitions/restoredLogsType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Restore parameters."
-                              }
-                            },
-                            "retentionInDays": {
-                              "type": "int",
-                              "defaultValue": -1,
-                              "minValue": -1,
-                              "maxValue": 730,
-                              "metadata": {
-                                "description": "Optional. The table retention in days, between 4 and 730. Setting this property to -1 will default to the workspace retention."
-                              }
-                            },
-                            "schema": {
-                              "$ref": "#/definitions/schemaType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Table's schema."
-                              }
-                            },
-                            "searchResults": {
-                              "$ref": "#/definitions/searchResultsType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Parameters of the search job that initiated this table."
-                              }
-                            },
-                            "totalRetentionInDays": {
-                              "type": "int",
-                              "defaultValue": -1,
-                              "minValue": -1,
-                              "maxValue": 2555,
-                              "metadata": {
-                                "description": "Optional. The table total retention in days, between 4 and 2555. Setting this property to -1 will default to table retention."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "Log Analytics Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]",
-                              "Log Analytics Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '73c42c96-874c-492b-b04d-ab87d138a893')]",
-                              "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]",
-                              "Monitoring Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '43d0d8ad-25c7-4714-9337-8ba259a9fe05')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                            }
-                          },
-                          "resources": {
-                            "workspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2025-02-01",
-                              "name": "[parameters('workspaceName')]"
-                            },
-                            "table": {
-                              "type": "Microsoft.OperationalInsights/workspaces/tables",
-                              "apiVersion": "2025-02-01",
-                              "name": "[format('{0}/{1}', parameters('workspaceName'), parameters('name'))]",
-                              "properties": {
-                                "plan": "[parameters('plan')]",
-                                "restoredLogs": "[parameters('restoredLogs')]",
-                                "retentionInDays": "[parameters('retentionInDays')]",
-                                "schema": "[parameters('schema')]",
-                                "searchResults": "[parameters('searchResults')]",
-                                "totalRetentionInDays": "[parameters('totalRetentionInDays')]"
-                              }
-                            },
-                            "table_roleAssignments": {
-                              "copy": {
-                                "name": "table_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}/tables/{1}', parameters('workspaceName'), parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "table"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the table."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the table."
-                              },
-                              "value": "[resourceId('Microsoft.OperationalInsights/workspaces/tables', parameters('workspaceName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the table was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    },
-                    "logAnalyticsWorkspace_solutions": {
-                      "copy": {
-                        "name": "logAnalyticsWorkspace_solutions",
-                        "count": "[length(coalesce(parameters('gallerySolutions'), createArray()))]"
-                      },
-                      "condition": "[not(empty(parameters('gallerySolutions')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-LAW-Solution-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].name]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "logAnalyticsWorkspaceName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "plan": {
-                            "value": "[coalesce(parameters('gallerySolutions'), createArray())[copyIndex()].plan]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.32.4.45862",
-                              "templateHash": "10255889523646649592"
-                            },
-                            "name": "Operations Management Solutions",
-                            "description": "This module deploys an Operations Management Solution.",
-                            "owner": "Azure/module-maintainers"
-                          },
-                          "definitions": {
-                            "solutionPlanType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of the solution to be created.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, it can be anything.\nThe solution type is case-sensitive.\nIf not provided, the value of the `name` parameter will be used."
-                                  }
-                                },
-                                "product": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The product name of the deployed solution.\nFor Microsoft published gallery solution it should be `OMSGallery/{solutionType}`, for example `OMSGallery/AntiMalware`.\nFor a third party solution, it can be anything.\nThis is case sensitive."
-                                  }
-                                },
-                                "publisher": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The publisher name of the deployed solution. For Microsoft published gallery solution, it is `Microsoft`, which is the default value."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the solution.\nFor solutions authored by Microsoft, the name must be in the pattern: `SolutionType(WorkspaceName)`, for example: `AntiMalware(contoso-Logs)`.\nFor solutions authored by third parties, the name should be in the pattern: `SolutionType[WorkspaceName]`, for example `MySolution[contoso-Logs]`.\nThe solution type is case-sensitive."
-                              }
-                            },
-                            "plan": {
-                              "$ref": "#/definitions/solutionPlanType",
-                              "metadata": {
-                                "description": "Required. Plan for solution object supported by the OperationsManagement resource provider."
-                              }
-                            },
-                            "logAnalyticsWorkspaceName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the Log Analytics workspace where the solution will be deployed/enabled."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all resources."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.operationsmanagement-solution.{0}.{1}', replace('0.3.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "logAnalyticsWorkspace": {
-                              "existing": true,
-                              "type": "Microsoft.OperationalInsights/workspaces",
-                              "apiVersion": "2021-06-01",
-                              "name": "[parameters('logAnalyticsWorkspaceName')]"
-                            },
-                            "solution": {
-                              "type": "Microsoft.OperationsManagement/solutions",
-                              "apiVersion": "2015-11-01-preview",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "properties": {
-                                "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
-                              },
-                              "plan": {
-                                "name": "[coalesce(tryGet(parameters('plan'), 'name'), parameters('name'))]",
-                                "promotionCode": "",
-                                "product": "[parameters('plan').product]",
-                                "publisher": "[coalesce(tryGet(parameters('plan'), 'publisher'), 'Microsoft')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed solution."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed solution."
-                              },
-                              "value": "[resourceId('Microsoft.OperationsManagement/solutions', parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group where the solution is deployed."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('solution', '2015-11-01-preview', 'full').location]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "logAnalyticsWorkspace"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed log analytics workspace."
-                      },
-                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed log analytics workspace."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed log analytics workspace."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "logAnalyticsWorkspaceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The ID associated with the workspace."
-                      },
-                      "value": "[reference('logAnalyticsWorkspace').customerId]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('logAnalyticsWorkspace', '2025-02-01', 'full').location]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('logAnalyticsWorkspace', '2025-02-01', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "primarySharedKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary shared key of the log analytics workspace."
-                      },
-                      "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').primarySharedKey]"
-                    },
-                    "secondarySharedKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary shared key of the log analytics workspace."
-                      },
-                      "value": "[listKeys('logAnalyticsWorkspace', '2025-02-01').secondarySharedKey]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('logAnalytics').outputs.resourceId.value]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[reference('logAnalytics').outputs.name.value]"
-            },
-            "logAnalyticsWorkspaceId": {
-              "type": "string",
-              "value": "[reference('logAnalytics').outputs.logAnalyticsWorkspaceId.value]"
-            },
-            "primarySharedKey": {
-              "type": "securestring",
-              "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').primarySharedKey]"
-            },
-            "secondarySharedKey": {
-              "type": "securestring",
-              "value": "[listOutputsWithSecureValues('logAnalytics', '2025-04-01').secondarySharedKey]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "userAssignedIdentity"
-      ]
-    },
-    "appInsights": {
-      "condition": "[variables('shouldCreateAppInsights')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('appInsights-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "appInsightsName": {
-            "value": "[variables('appInsightsName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "logAnalyticsResourceId": "[if(not(empty(parameters('existingLogAnalyticsWorkspaceId'))), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), if(variables('shouldCreateLogAnalytics'), createObject('value', reference('logAnalytics').outputs.resourceId.value), createObject('value', '')))]",
-          "roleAssignedManagedIdentityPrincipalIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.principalId.value]"
-            ]
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "7816056445250265887"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Location for all resources"
-              }
-            },
-            "appInsightsName": {
-              "type": "string",
-              "metadata": {
-                "description": "Application Insights name"
-              }
-            },
-            "logAnalyticsResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Log Analytics resource id output from log-analytics-ws.bicep module"
-              }
-            },
-            "roleAssignedManagedIdentityPrincipalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "defaultValue": [],
-              "metadata": {
-                "description": "Managed Identity that will be given access to the Application Insights"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "resources": {
-            "applicationInsights": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('applicationInsights-{0}', uniqueString('applicationInsights', deployment().name))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('appInsightsName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "workspaceResourceId": {
-                    "value": "[parameters('logAnalyticsResourceId')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "disableLocalAuth": {
-                    "value": false
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.33.93.31351",
-                      "templateHash": "5735496719243704506"
-                    },
-                    "name": "Application Insights",
-                    "description": "This component deploys an Application Insights instance."
-                  },
-                  "definitions": {
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.3.0"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Application Insights."
-                      }
-                    },
-                    "applicationType": {
-                      "type": "string",
-                      "defaultValue": "web",
-                      "allowedValues": [
-                        "web",
-                        "other"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Application type."
-                      }
-                    },
-                    "workspaceResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of the log analytics workspace which the data will be ingested to. This property is required to create an application with this API version. Applications from older versions will not have this property."
-                      }
-                    },
-                    "disableIpMasking": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Disable IP masking. Default value is set to true."
-                      }
-                    },
-                    "disableLocalAuth": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Disable Non-AAD based Auth. Default value is set to false."
-                      }
-                    },
-                    "forceCustomerStorageForProfiler": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Force users to create their own storage account for profiler and debugger."
-                      }
-                    },
-                    "linkedStorageAccountResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Linked storage account resource ID."
-                      }
-                    },
-                    "publicNetworkAccessForIngestion": {
-                      "type": "string",
-                      "defaultValue": "Enabled",
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The network access type for accessing Application Insights ingestion. - Enabled or Disabled."
-                      }
-                    },
-                    "publicNetworkAccessForQuery": {
-                      "type": "string",
-                      "defaultValue": "Enabled",
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The network access type for accessing Application Insights query. - Enabled or Disabled."
-                      }
-                    },
-                    "retentionInDays": {
-                      "type": "int",
-                      "defaultValue": 365,
-                      "allowedValues": [
-                        30,
-                        60,
-                        90,
-                        120,
-                        180,
-                        270,
-                        365,
-                        550,
-                        730
-                      ],
-                      "metadata": {
-                        "description": "Optional. Retention period in days."
-                      }
-                    },
-                    "samplingPercentage": {
-                      "type": "int",
-                      "defaultValue": 100,
-                      "minValue": 0,
-                      "maxValue": 100,
-                      "metadata": {
-                        "description": "Optional. Percentage of the data produced by the application being monitored that is being sampled for Application Insights telemetry."
-                      }
-                    },
-                    "flowType": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Used by the Application Insights system to determine what kind of flow this component was created by. This is to be set to 'Bluefield' when creating/updating a component via the REST API."
-                      }
-                    },
-                    "requestSource": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Describes what tool created this Application Insights component. Customers using this API should set this to the default 'rest'."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. The kind of application that this component refers to, used to customize UI. This value is a freeform string, values should typically be one of the following: web, ios, other, store, java, phone."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Tags of the resource."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]",
-                      "Monitoring Metrics Publisher": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
-                      "Application Insights Component Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ae349356-3a1b-4a5e-921d-050484c6347e')]",
-                      "Application Insights Snapshot Debugger": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '08954f03-6346-4c2e-81c0-ec3a5cfae23b')]",
-                      "Monitoring Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '749f88d5-cbae-40b8-bcfc-e573ddc772fa')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.insights-component.{0}.{1}', replace('0.6.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "appInsights": {
-                      "type": "Microsoft.Insights/components",
-                      "apiVersion": "2020-02-02",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "kind": "[parameters('kind')]",
-                      "properties": {
-                        "Application_Type": "[parameters('applicationType')]",
-                        "DisableIpMasking": "[parameters('disableIpMasking')]",
-                        "DisableLocalAuth": "[parameters('disableLocalAuth')]",
-                        "ForceCustomerStorageForProfiler": "[parameters('forceCustomerStorageForProfiler')]",
-                        "WorkspaceResourceId": "[parameters('workspaceResourceId')]",
-                        "publicNetworkAccessForIngestion": "[parameters('publicNetworkAccessForIngestion')]",
-                        "publicNetworkAccessForQuery": "[parameters('publicNetworkAccessForQuery')]",
-                        "RetentionInDays": "[parameters('retentionInDays')]",
-                        "SamplingPercentage": "[parameters('samplingPercentage')]",
-                        "Flow_Type": "[parameters('flowType')]",
-                        "Request_Source": "[parameters('requestSource')]"
-                      }
-                    },
-                    "appInsights_roleAssignments": {
-                      "copy": {
-                        "name": "appInsights_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Insights/components', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "appInsights"
-                      ]
-                    },
-                    "appInsights_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                      },
-                      "dependsOn": [
-                        "appInsights"
-                      ]
-                    },
-                    "appInsights_diagnosticSettings": {
-                      "copy": {
-                        "name": "appInsights_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Insights/components/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "appInsights"
-                      ]
-                    },
-                    "linkedStorageAccount": {
-                      "condition": "[not(empty(parameters('linkedStorageAccountResourceId')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-appInsights-linkedStorageAccount', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "appInsightsName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "storageAccountResourceId": {
-                            "value": "[coalesce(parameters('linkedStorageAccountResourceId'), '')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.33.93.31351",
-                              "templateHash": "10861379689695100897"
-                            },
-                            "name": "Application Insights Linked Storage Account",
-                            "description": "This component deploys an Application Insights Linked Storage Account."
-                          },
-                          "parameters": {
-                            "appInsightsName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Application Insights instance. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "storageAccountResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Linked storage account resource ID."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "microsoft.insights/components/linkedStorageAccounts",
-                              "apiVersion": "2020-03-01-preview",
-                              "name": "[format('{0}/{1}', parameters('appInsightsName'), 'ServiceProfiler')]",
-                              "properties": {
-                                "linkedStorageAccount": "[parameters('storageAccountResourceId')]"
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the Linked Storage Account."
-                              },
-                              "value": "ServiceProfiler"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the Linked Storage Account."
-                              },
-                              "value": "[resourceId('microsoft.insights/components/linkedStorageAccounts', parameters('appInsightsName'), 'ServiceProfiler')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the agent pool was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "appInsights"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the application insights component."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the application insights component."
-                      },
-                      "value": "[resourceId('Microsoft.Insights/components', parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the application insights component was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "applicationId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The application ID of the application insights component."
-                      },
-                      "value": "[reference('appInsights').AppId]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('appInsights', '2020-02-02', 'full').location]"
-                    },
-                    "instrumentationKey": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Application Insights Instrumentation key. A read-only value that applications can use to identify the destination for all telemetry sent to Azure Application Insights. This value will be supplied upon construction of each new Application Insights component."
-                      },
-                      "value": "[reference('appInsights').InstrumentationKey]"
-                    },
-                    "connectionString": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Application Insights Connection String."
-                      },
-                      "value": "[reference('appInsights').ConnectionString]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('applicationInsights').outputs.resourceId.value]"
-            },
-            "applicationId": {
-              "type": "string",
-              "value": "[reference('applicationInsights').outputs.applicationId.value]"
-            },
-            "instrumentationKey": {
-              "type": "string",
-              "value": "[reference('applicationInsights').outputs.instrumentationKey.value]"
-            },
-            "connectionString": {
-              "type": "string",
-              "value": "[reference('applicationInsights').outputs.connectionString.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalytics",
-        "userAssignedIdentity"
-      ]
-    },
-    "queueDnsZone": {
-      "condition": "[variables('shouldCreateQueueDnsZone')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('queue-dns-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "vnetResourceId": {
-            "value": "[parameters('existingVnetResourceId')]"
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "18409778870475030310"
-            }
-          },
-          "parameters": {
-            "vnetResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Resource ID of the VNet to link the DNS zone to"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Network/privateDnsZones",
-              "apiVersion": "2024-06-01",
-              "name": "privatelink.queue.core.windows.net",
-              "location": "global",
-              "tags": "[parameters('tags')]"
-            },
-            {
-              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
-              "apiVersion": "2024-06-01",
-              "name": "[format('{0}/{1}', 'privatelink.queue.core.windows.net', format('{0}-queue-link', last(split(parameters('vnetResourceId'), '/'))))]",
-              "location": "global",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "virtualNetwork": {
-                  "id": "[parameters('vnetResourceId')]"
-                },
-                "registrationEnabled": false
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.queue.core.windows.net')]"
-              ]
-            }
-          ],
-          "outputs": {
-            "dnsZoneId": {
-              "type": "string",
-              "value": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.queue.core.windows.net')]"
-            }
-          }
-        }
-      }
-    },
-    "storage": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('storage-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "storageAccountName": {
-            "value": "[variables('storageAccountName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "docsContainerName": {
-            "value": "[parameters('docsContainerName')]"
-          },
-          "roleAssignedManagedIdentityPrincipalIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.principalId.value]"
-            ]
-          },
-          "enablePrivateEndpoint": {
-            "value": "[variables('isAILZIntegrated')]"
-          },
-          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
-          "blobPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.blob), createObject('value', ''))]",
-          "queuePrivateDnsZoneId": "[if(variables('isAILZIntegrated'), if(not(empty(parameters('existingQueuePrivateDnsZoneId'))), createObject('value', parameters('existingQueuePrivateDnsZoneId')), if(variables('shouldCreateQueueDnsZone'), createObject('value', reference('queueDnsZone').outputs.dnsZoneId.value), createObject('value', ''))), createObject('value', ''))]",
-          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-          "logAnalyticsWorkspaceId": "[if(not(empty(parameters('existingLogAnalyticsWorkspaceId'))), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), if(variables('shouldCreateLogAnalytics'), createObject('value', reference('logAnalytics').outputs.resourceId.value), createObject('value', '')))]",
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "1736139892580946894"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Location for all resources"
-              }
-            },
-            "storageAccountName": {
-              "type": "string",
-              "metadata": {
-                "description": "Storage account name"
-              }
-            },
-            "skuName": {
-              "type": "string",
-              "defaultValue": "Standard_LRS",
-              "allowedValues": [
-                "Standard_LRS",
-                "Standard_GRS",
-                "Standard_RAGRS",
-                "Standard_ZRS",
-                "Premium_LRS",
-                "Premium_ZRS"
-              ],
-              "metadata": {
-                "description": "Storage account SKU name"
-              }
-            },
-            "docsContainerName": {
-              "type": "string",
-              "metadata": {
-                "description": "Container name for documents"
-              }
-            },
-            "roleAssignedManagedIdentityPrincipalIds": {
-              "type": "array",
-              "metadata": {
-                "description": "Managed identities that will be given access to the storage account"
-              }
-            },
-            "enablePrivateEndpoint": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Enable private endpoint for AILZ mode"
-              }
-            },
-            "privateEndpointSubnetId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "blobPrivateDnsZoneId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Blob Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "queuePrivateDnsZoneId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Queue Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "defaultValue": "Disabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Public network access setting"
-              }
-            },
-            "logAnalyticsWorkspaceId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Log Analytics Workspace ID for diagnostic settings"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "accountRoleAssignments",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('accountRoleAssignments')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "Contributor"
-                }
-              },
-              {
-                "name": "blobRoleAssignments",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('blobRoleAssignments')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "Storage Blob Data Contributor"
-                }
-              },
-              {
-                "name": "queueRoleAssignments",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('queueRoleAssignments')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "Storage Queue Data Contributor"
-                }
-              }
-            ],
-            "deployerRoleAssignments": [
-              {
-                "principalId": "[deployer().objectId]",
-                "principalType": "User",
-                "roleDefinitionIdOrName": "Storage Blob Data Contributor"
-              },
-              {
-                "principalId": "[deployer().objectId]",
-                "principalType": "User",
-                "roleDefinitionIdOrName": "Storage Queue Data Contributor"
-              }
-            ]
-          },
-          "resources": {
-            "storageAccount": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}.storageAccount', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('storageAccountName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "kind": {
-                    "value": "StorageV2"
-                  },
-                  "skuName": {
-                    "value": "[parameters('skuName')]"
-                  },
-                  "accessTier": {
-                    "value": "Hot"
-                  },
-                  "diagnosticSettings": {
-                    "value": [
-                      {
-                        "workspaceResourceId": "[parameters('logAnalyticsWorkspaceId')]"
-                      }
-                    ]
-                  },
-                  "allowSharedKeyAccess": {
-                    "value": false
-                  },
-                  "enableHierarchicalNamespace": {
-                    "value": false
-                  },
-                  "publicNetworkAccess": {
-                    "value": "[parameters('publicNetworkAccess')]"
-                  },
-                  "networkAcls": "[if(parameters('enablePrivateEndpoint'), createObject('value', createObject('defaultAction', 'Deny', 'bypass', 'AzureServices', 'ipRules', createArray(), 'virtualNetworkRules', createArray())), createObject('value', createObject('defaultAction', 'Allow', 'bypass', 'AzureServices')))]",
-                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-blob-pe', parameters('storageAccountName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'blob', 'privateLinkServiceConnectionName', format('{0}-blob-plsc', parameters('storageAccountName')), 'privateDnsZoneGroup', if(not(empty(parameters('blobPrivateDnsZoneId'))), createObject('name', 'blob-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'blob-config', 'privateDnsZoneResourceId', parameters('blobPrivateDnsZoneId')))), null())), createObject('name', format('{0}-queue-pe', parameters('storageAccountName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'queue', 'privateLinkServiceConnectionName', format('{0}-queue-plsc', parameters('storageAccountName')), 'privateDnsZoneGroup', if(not(empty(parameters('queuePrivateDnsZoneId'))), createObject('name', 'queue-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'queue-config', 'privateDnsZoneResourceId', parameters('queuePrivateDnsZoneId')))), null())))), createObject('value', createArray()))]",
-                  "blobServices": {
-                    "value": {
-                      "automaticSnapshotPolicyEnabled": true,
-                      "deleteRetentionPolicyDays": 7,
-                      "deleteRetentionPolicyEnabled": true,
-                      "containerDeleteRetentionPolicyDays": 7,
-                      "containerDeleteRetentionPolicyEnabled": true,
-                      "containers": [
-                        {
-                          "name": "[parameters('docsContainerName')]",
-                          "publicAccess": "None"
-                        }
-                      ]
-                    }
-                  },
-                  "queueServices": {
-                    "value": {
-                      "queues": [
-                        {
-                          "name": "contentflow-execution-requests",
-                          "metadata": {}
-                        }
-                      ]
-                    }
-                  },
-                  "roleAssignments": {
-                    "value": "[concat(variables('accountRoleAssignments'), variables('blobRoleAssignments'), variables('queueRoleAssignments'), variables('deployerRoleAssignments'))]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.37.4.10188",
-                      "templateHash": "3530476863855541150"
-                    },
-                    "name": "Storage Accounts",
-                    "description": "This module deploys a Storage Account."
-                  },
-                  "definitions": {
-                    "privateEndpointOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group Id for the private endpoint Group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "FQDN that resolves to private endpoint IP address."
-                                }
-                              },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses of the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the private endpoints output."
-                      }
-                    },
-                    "networkAclsType": {
-                      "type": "object",
-                      "properties": {
-                        "resourceAccessRules": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "tenantId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The ID of the tenant in which the resource resides in."
-                                }
-                              },
-                              "resourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
-                          }
-                        },
-                        "bypass": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureServices",
-                            "AzureServices, Logging",
-                            "AzureServices, Logging, Metrics",
-                            "AzureServices, Metrics",
-                            "Logging",
-                            "Logging, Metrics",
-                            "Metrics",
-                            "None"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
-                          }
-                        },
-                        "virtualNetworkRules": {
-                          "type": "array",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Sets the virtual network rules."
-                          }
-                        },
-                        "ipRules": {
-                          "type": "array",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Sets the IP ACL rules."
-                          }
-                        },
-                        "defaultAction": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Allow",
-                            "Deny"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the default action of allow or deny when no other rules match."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the network configuration."
-                      }
-                    },
-                    "secretsExportConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "keyVaultResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
-                          }
-                        },
-                        "accessKey1Name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The accessKey1 secret name to create."
-                          }
-                        },
-                        "connectionString1Name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The connectionString1 secret name to create."
-                          }
-                        },
-                        "accessKey2Name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The accessKey2 secret name to create."
-                          }
-                        },
-                        "connectionString2Name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The connectionString2 secret name to create."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type of the exported secrets."
-                      }
-                    },
-                    "localUserType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the local user used for SFTP Authentication."
-                          }
-                        },
-                        "hasSharedKey": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
-                          }
-                        },
-                        "hasSshKey": {
-                          "type": "bool",
-                          "metadata": {
-                            "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
-                          }
-                        },
-                        "hasSshPassword": {
-                          "type": "bool",
-                          "metadata": {
-                            "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
-                          }
-                        },
-                        "homeDirectory": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The local user home directory."
-                          }
-                        },
-                        "permissionScopes": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/permissionScopeType"
-                          },
-                          "metadata": {
-                            "description": "Required. The permission scopes of the local user."
-                          }
-                        },
-                        "sshAuthorizedKeys": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/sshAuthorizedKeyType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The local user SSH authorized keys for SFTP."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type of a local user."
-                      }
-                    },
-                    "blobServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "automaticSnapshotPolicyEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Automatic Snapshot is enabled if set to true."
-                          }
-                        },
-                        "changeFeedEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
-                          }
-                        },
-                        "changeFeedRetentionInDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 146000,
-                          "metadata": {
-                            "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
-                          }
-                        },
-                        "containerDeleteRetentionPolicyEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
-                          }
-                        },
-                        "containerDeleteRetentionPolicyDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 365,
-                          "metadata": {
-                            "description": "Optional. Indicates the number of days that the deleted item should be retained."
-                          }
-                        },
-                        "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                          }
-                        },
-                        "corsRules": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/corsRuleType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                          }
-                        },
-                        "defaultServiceVersion": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
-                          }
-                        },
-                        "deleteRetentionPolicyEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The blob service properties for blob soft delete."
-                          }
-                        },
-                        "deleteRetentionPolicyDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 365,
-                          "metadata": {
-                            "description": "Optional. Indicates the number of days that the deleted blob should be retained."
-                          }
-                        },
-                        "deleteRetentionPolicyAllowPermanentDelete": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                          }
-                        },
-                        "isVersioningEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
-                          }
-                        },
-                        "lastAccessTimeTrackingPolicyEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
-                          }
-                        },
-                        "restorePolicyEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
-                          }
-                        },
-                        "restorePolicyDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "metadata": {
-                            "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
-                          }
-                        },
-                        "containers": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/containerType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Blob containers to create."
-                          }
-                        },
-                        "diagnosticSettings": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/diagnosticSettingFullType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The diagnostic settings of the service."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type of a blob service."
-                      }
-                    },
-                    "_1.immutabilityPolicyType": {
-                      "type": "object",
-                      "properties": {
-                        "immutabilityPeriodSinceCreationInDays": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                          }
-                        },
-                        "allowProtectedAppendWrites": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                          }
-                        },
-                        "allowProtectedAppendWritesAll": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for an immutability policy.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "blob-service/container/main.bicep"
-                        }
-                      }
-                    },
-                    "_2.secretSetOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "secretResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resourceId of the exported secret."
-                          }
-                        },
-                        "secretUri": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The secret URI of the exported secret."
-                          }
-                        },
-                        "secretUriWithVersion": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The secret URI with version of the exported secret."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "_3.lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_3.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_3.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_3.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                }
-                              },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_3.roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "containerType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the Storage Container to deploy."
-                          }
-                        },
-                        "defaultEncryptionScope": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Default the container to use specified encryption scope for all writes."
-                          }
-                        },
-                        "denyEncryptionScopeOverride": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Block override of encryption scope from the container default."
-                          }
-                        },
-                        "enableNfsV3AllSquash": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable NFSv3 all squash on blob container."
-                          }
-                        },
-                        "enableNfsV3RootSquash": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable NFSv3 root squash on blob container."
-                          }
-                        },
-                        "immutableStorageWithVersioningEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                          }
-                        },
-                        "immutabilityPolicy": {
-                          "$ref": "#/definitions/_1.immutabilityPolicyType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Configure immutability policy."
-                          }
-                        },
-                        "metadata": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
-                            },
-                            "description": "Optional. A name-value pair to associate with the container as metadata."
-                          },
-                          "nullable": true
-                        },
-                        "publicAccess": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Blob",
-                            "Container",
-                            "None"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_3.roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type of a storage container.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "blob-service/main.bicep"
-                        }
-                      }
-                    },
-                    "corsRuleType": {
-                      "type": "object",
-                      "properties": {
-                        "allowedHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                          }
-                        },
-                        "allowedMethods": {
-                          "type": "array",
-                          "allowedValues": [
-                            "CONNECT",
-                            "DELETE",
-                            "GET",
-                            "HEAD",
-                            "MERGE",
-                            "OPTIONS",
-                            "PATCH",
-                            "POST",
-                            "PUT",
-                            "TRACE"
-                          ],
-                          "metadata": {
-                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                          }
-                        },
-                        "allowedOrigins": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                          }
-                        },
-                        "exposedHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of response headers to expose to CORS clients."
-                          }
-                        },
-                        "maxAgeInSeconds": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a cors rule.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "blob-service/main.bicep"
-                        }
-                      }
-                    },
-                    "customerManagedKeyWithAutoRotateType": {
-                      "type": "object",
-                      "properties": {
-                        "keyVaultResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                          }
-                        },
-                        "keyName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the customer managed key to use for encryption."
-                          }
-                        },
-                        "keyVersion": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
-                          }
-                        },
-                        "autoRotationEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
-                          }
-                        },
-                        "userAssignedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "diagnosticSettingMetricsOnlyType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of diagnostic setting."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "permissionScopeType": {
-                      "type": "object",
-                      "properties": {
-                        "permissions": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
-                          }
-                        },
-                        "resourceName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The service used by the local user, e.g. blob, file."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "local-user/main.bicep"
-                        }
-                      }
-                    },
-                    "privateEndpointMultiServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private endpoint."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location to deploy the private endpoint to."
-                          }
-                        },
-                        "privateLinkServiceConnectionName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private link connection to create."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
-                          }
-                        },
-                        "subnetResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                          }
-                        },
-                        "resourceGroupResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                          }
-                        },
-                        "privateDnsZoneGroup": {
-                          "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                          }
-                        },
-                        "isManualConnection": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. If Manual Private Link Connection is required."
-                          }
-                        },
-                        "manualConnectionRequestMessage": {
-                          "type": "string",
-                          "nullable": true,
-                          "maxLength": 140,
-                          "metadata": {
-                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom DNS configurations."
-                          }
-                        },
-                        "ipConfigurations": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_3.privateEndpointIpConfigurationType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                          }
-                        },
-                        "applicationSecurityGroupResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                          }
-                        },
-                        "customNetworkInterfaceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                          }
-                        },
-                        "lock": {
-                          "$ref": "#/definitions/_3.lockType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_3.roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                            },
-                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                          }
-                        },
-                        "enableTelemetry": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable/Disable usage telemetry for module."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "secretsOutputType": {
-                      "type": "object",
-                      "properties": {},
-                      "additionalProperties": {
-                        "$ref": "#/definitions/_2.secretSetOutputType",
-                        "metadata": {
-                          "description": "An exported secret's references."
-                        }
-                      },
-                      "metadata": {
-                        "description": "A map of the exported secrets",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "sshAuthorizedKeyType": {
-                      "type": "object",
-                      "properties": {
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Description used to store the function/usage of the key."
-                          }
-                        },
-                        "key": {
-                          "type": "securestring",
-                          "metadata": {
-                            "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "local-user/main.bicep"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "maxLength": 24,
-                      "metadata": {
-                        "description": "Required. Name of the Storage Account. Must be lower-case."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "defaultValue": "StorageV2",
-                      "allowedValues": [
-                        "Storage",
-                        "StorageV2",
-                        "BlobStorage",
-                        "FileStorage",
-                        "BlockBlobStorage"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Type of Storage Account to create."
-                      }
-                    },
-                    "skuName": {
-                      "type": "string",
-                      "defaultValue": "Standard_GRS",
-                      "allowedValues": [
-                        "Standard_LRS",
-                        "Standard_ZRS",
-                        "Standard_GRS",
-                        "Standard_GZRS",
-                        "Standard_RAGRS",
-                        "Standard_RAGZRS",
-                        "StandardV2_LRS",
-                        "StandardV2_ZRS",
-                        "StandardV2_GRS",
-                        "StandardV2_GZRS",
-                        "Premium_LRS",
-                        "Premium_ZRS",
-                        "PremiumV2_LRS",
-                        "PremiumV2_ZRS"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage."
-                      }
-                    },
-                    "accessTier": {
-                      "type": "string",
-                      "defaultValue": "Hot",
-                      "allowedValues": [
-                        "Premium",
-                        "Hot",
-                        "Cool",
-                        "Cold"
-                      ],
-                      "metadata": {
-                        "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
-                      }
-                    },
-                    "largeFileSharesState": {
-                      "type": "string",
-                      "defaultValue": "Disabled",
-                      "allowedValues": [
-                        "Disabled",
-                        "Enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
-                      }
-                    },
-                    "azureFilesIdentityBasedAuthentication": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication"
-                        },
-                        "description": "Optional. Provides the identity based authentication settings for Azure Files."
-                      },
-                      "nullable": true
-                    },
-                    "defaultToOAuthAuthentication": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
-                      }
-                    },
-                    "allowSharedKeyAccess": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointMultiServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                      }
-                    },
-                    "managementPolicyRules": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The Storage Account ManagementPolicies Rules."
-                      }
-                    },
-                    "networkAcls": {
-                      "$ref": "#/definitions/networkAclsType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
-                      }
-                    },
-                    "requireInfrastructureEncryption": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
-                      }
-                    },
-                    "allowCrossTenantReplication": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Allow or disallow cross AAD tenant object replication."
-                      }
-                    },
-                    "customDomainName": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
-                      }
-                    },
-                    "customDomainUseSubDomainName": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
-                      }
-                    },
-                    "dnsEndpointType": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "AzureDnsZone",
-                        "Standard"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
-                      }
-                    },
-                    "blobServices": {
-                      "$ref": "#/definitions/blobServiceType",
-                      "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
-                      "metadata": {
-                        "description": "Optional. Blob service and containers to deploy."
-                      }
-                    },
-                    "fileServices": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. File service and shares to deploy."
-                      }
-                    },
-                    "queueServices": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Queue service and queues to create."
-                      }
-                    },
-                    "tableServices": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Table service and tables to create."
-                      }
-                    },
-                    "allowBlobPublicAccess": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
-                      }
-                    },
-                    "minimumTlsVersion": {
-                      "type": "string",
-                      "defaultValue": "TLS1_2",
-                      "allowedValues": [
-                        "TLS1_2"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore."
-                      }
-                    },
-                    "enableHierarchicalNamespace": {
-                      "type": "bool",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
-                      }
-                    },
-                    "enableSftp": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
-                      }
-                    },
-                    "localUsers": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/localUserType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Local users to deploy for SFTP authentication."
-                      }
-                    },
-                    "isLocalUserEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Enables local users feature, if set to true."
-                      }
-                    },
-                    "enableNfsV3": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "allowedCopyScope": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "AAD",
-                        "PrivateLink"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
-                      }
-                    },
-                    "publicNetworkAccess": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-                      }
-                    },
-                    "supportsHttpsTrafficOnly": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
-                      }
-                    },
-                    "customerManagedKey": {
-                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The customer managed key definition."
-                      }
-                    },
-                    "sasExpirationPeriod": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
-                      }
-                    },
-                    "sasExpirationAction": {
-                      "type": "string",
-                      "defaultValue": "Log",
-                      "allowedValues": [
-                        "Block",
-                        "Log"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The SAS expiration action. Allowed values are Block and Log."
-                      }
-                    },
-                    "keyType": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Account",
-                        "Service"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The keyType to use with Queue & Table services."
-                      }
-                    },
-                    "secretsExportConfiguration": {
-                      "$ref": "#/definitions/secretsExportConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
-                      }
-                    },
-                    "immutableStorageWithVersioning": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning"
-                        },
-                        "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts."
-                      },
-                      "nullable": true
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "enableReferencedModulesTelemetry": false,
-                    "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]",
-                    "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
-                    "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
-                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
-                      "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
-                      "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
-                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
-                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
-                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
-                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
-                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
-                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
-                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
-                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "cMKKeyVault::cMKKey": {
-                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults/keys",
-                      "apiVersion": "2024-11-01",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
-                    },
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "cMKKeyVault": {
-                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2024-11-01",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
-                    },
-                    "cMKUserAssignedIdentity": {
-                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-                      "apiVersion": "2024-11-30",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-                    },
-                    "storageAccount": {
-                      "type": "Microsoft.Storage/storageAccounts",
-                      "apiVersion": "2024-01-01",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "kind": "[parameters('kind')]",
-                      "sku": {
-                        "name": "[parameters('skuName')]"
-                      },
-                      "identity": "[variables('identity')]",
-                      "tags": "[parameters('tags')]",
-                      "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]",
-                      "dependsOn": [
-                        "cMKKeyVault",
-                        "cMKKeyVault::cMKKey"
-                      ]
-                    },
-                    "storageAccount_diagnosticSettings": {
-                      "copy": {
-                        "name": "storageAccount_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_roleAssignments": {
-                      "copy": {
-                        "name": "storageAccount_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_privateEndpoints": {
-                      "copy": {
-                        "name": "storageAccount_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
-                          },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                          },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                          },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                          },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                          },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                          },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "12389807800450456797"
-                            },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                  }
-                                },
-                                "privateDnsZoneGroupConfigs": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "ipConfigurationType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "memberName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "privateIPAddress": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private endpoint IP configurations."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "privateLinkServiceConnectionType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the private link service connection."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupIds": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                      }
-                                    },
-                                    "privateLinkServiceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource id of private link service."
-                                      }
-                                    },
-                                    "requestMessage": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private link service connection."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "customDnsConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "fqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                  }
-                                },
-                                "ipAddresses": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/ipConfigurationType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              }
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                              }
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Custom DNS configurations."
-                              }
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-05-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                    }
-                                  }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
-                                }
-                              }
-                            },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_roleAssignments": {
-                              "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                  },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.34.44.8038",
-                                      "templateHash": "13997305779829540948"
-                                    },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
-                                          }
-                                        },
-                                        "privateDnsZoneResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "privateEndpointName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "privateDnsZoneConfigs": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 5,
-                                      "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "privateDnsZoneConfigsVar",
-                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                        "input": {
-                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                          "properties": {
-                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                          }
-                                        }
-                                      }
-                                    ]
-                                  },
-                                  "resources": {
-                                    "privateEndpoint": {
-                                      "existing": true,
-                                      "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                      "properties": {
-                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "metadata": {
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                            },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                            },
-                            "groupId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_managementPolicies": {
-                      "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "rules": {
-                            "value": "[parameters('managementPolicyRules')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "14529265638306912023"
-                            },
-                            "name": "Storage Account Management Policies",
-                            "description": "This module deploys a Storage Account Management Policy."
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "rules": {
-                              "type": "array",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules"
-                                },
-                                "description": "Required. The Storage Account ManagementPolicies Rules."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.Storage/storageAccounts/managementPolicies",
-                              "apiVersion": "2024-01-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
-                              "properties": {
-                                "policy": {
-                                  "rules": "[parameters('rules')]"
-                                }
-                              }
-                            }
-                          ],
-                          "outputs": {
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed management policy."
-                              },
-                              "value": "default"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed management policy."
-                              },
-                              "value": "default"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed management policy."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount",
-                        "storageAccount_blobServices"
-                      ]
-                    },
-                    "storageAccount_localUsers": {
-                      "copy": {
-                        "name": "storageAccount_localUsers",
-                        "count": "[length(coalesce(parameters('localUsers'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]"
-                          },
-                          "hasSshKey": {
-                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]"
-                          },
-                          "hasSshPassword": {
-                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]"
-                          },
-                          "permissionScopes": {
-                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]"
-                          },
-                          "hasSharedKey": {
-                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]"
-                          },
-                          "homeDirectory": {
-                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]"
-                          },
-                          "sshAuthorizedKeys": {
-                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "3261275799710495788"
-                            },
-                            "name": "Storage Account Local Users",
-                            "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication."
-                          },
-                          "definitions": {
-                            "sshAuthorizedKeyType": {
-                              "type": "object",
-                              "properties": {
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Description used to store the function/usage of the key."
-                                  }
-                                },
-                                "key": {
-                                  "type": "securestring",
-                                  "metadata": {
-                                    "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "permissionScopeType": {
-                              "type": "object",
-                              "properties": {
-                                "permissions": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
-                                  }
-                                },
-                                "resourceName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
-                                  }
-                                },
-                                "service": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The service used by the local user, e.g. blob, file."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the local user used for SFTP Authentication."
-                              }
-                            },
-                            "hasSharedKey": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
-                              }
-                            },
-                            "hasSshKey": {
-                              "type": "bool",
-                              "metadata": {
-                                "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
-                              }
-                            },
-                            "hasSshPassword": {
-                              "type": "bool",
-                              "metadata": {
-                                "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
-                              }
-                            },
-                            "homeDirectory": {
-                              "type": "string",
-                              "defaultValue": "",
-                              "metadata": {
-                                "description": "Optional. The local user home directory."
-                              }
-                            },
-                            "permissionScopes": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/permissionScopeType"
-                              },
-                              "metadata": {
-                                "description": "Required. The permission scopes of the local user."
-                              }
-                            },
-                            "sshAuthorizedKeys": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/sshAuthorizedKeyType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The local user SSH authorized keys for SFTP."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2024-01-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "localUsers": {
-                              "type": "Microsoft.Storage/storageAccounts/localUsers",
-                              "apiVersion": "2024-01-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
-                              "properties": {
-                                "hasSharedKey": "[parameters('hasSharedKey')]",
-                                "hasSshKey": "[parameters('hasSshKey')]",
-                                "hasSshPassword": "[parameters('hasSshPassword')]",
-                                "homeDirectory": "[parameters('homeDirectory')]",
-                                "permissionScopes": "[parameters('permissionScopes')]",
-                                "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed local user."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed local user."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed local user."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_blobServices": {
-                      "condition": "[not(empty(parameters('blobServices')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "containers": {
-                            "value": "[tryGet(parameters('blobServices'), 'containers')]"
-                          },
-                          "automaticSnapshotPolicyEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
-                          },
-                          "changeFeedEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
-                          },
-                          "changeFeedRetentionInDays": {
-                            "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
-                          },
-                          "containerDeleteRetentionPolicyEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
-                          },
-                          "containerDeleteRetentionPolicyDays": {
-                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
-                          },
-                          "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
-                          },
-                          "corsRules": {
-                            "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
-                          },
-                          "defaultServiceVersion": {
-                            "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
-                          },
-                          "deleteRetentionPolicyAllowPermanentDelete": {
-                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
-                          },
-                          "deleteRetentionPolicyEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
-                          },
-                          "deleteRetentionPolicyDays": {
-                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
-                          },
-                          "isVersioningEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
-                          },
-                          "lastAccessTimeTrackingPolicyEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
-                          },
-                          "restorePolicyEnabled": {
-                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
-                          },
-                          "restorePolicyDays": {
-                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
-                          },
-                          "diagnosticSettings": {
-                            "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "9925173705553594819"
-                            },
-                            "name": "Storage Account blob Services",
-                            "description": "This module deploys a Storage Account Blob Service."
-                          },
-                          "definitions": {
-                            "corsRuleType": {
-                              "type": "object",
-                              "properties": {
-                                "allowedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                  }
-                                },
-                                "allowedMethods": {
-                                  "type": "array",
-                                  "allowedValues": [
-                                    "CONNECT",
-                                    "DELETE",
-                                    "GET",
-                                    "HEAD",
-                                    "MERGE",
-                                    "OPTIONS",
-                                    "PATCH",
-                                    "POST",
-                                    "PUT",
-                                    "TRACE"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                  }
-                                },
-                                "allowedOrigins": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                  }
-                                },
-                                "exposedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                  }
-                                },
-                                "maxAgeInSeconds": {
-                                  "type": "int",
-                                  "metadata": {
-                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for a cors rule."
-                              }
-                            },
-                            "containerType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the Storage Container to deploy."
-                                  }
-                                },
-                                "defaultEncryptionScope": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Default the container to use specified encryption scope for all writes."
-                                  }
-                                },
-                                "denyEncryptionScopeOverride": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Block override of encryption scope from the container default."
-                                  }
-                                },
-                                "enableNfsV3AllSquash": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable NFSv3 all squash on blob container."
-                                  }
-                                },
-                                "enableNfsV3RootSquash": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enable NFSv3 root squash on blob container."
-                                  }
-                                },
-                                "immutableStorageWithVersioningEnabled": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                                  }
-                                },
-                                "immutabilityPolicy": {
-                                  "$ref": "#/definitions/immutabilityPolicyType",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Configure immutability policy."
-                                  }
-                                },
-                                "metadata": {
-                                  "type": "object",
-                                  "metadata": {
-                                    "__bicep_resource_derived_type!": {
-                                      "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
-                                    },
-                                    "description": "Optional. A name-value pair to associate with the container as metadata."
-                                  },
-                                  "nullable": true
-                                },
-                                "publicAccess": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Blob",
-                                    "Container",
-                                    "None"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                                  }
-                                },
-                                "roleAssignments": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/roleAssignmentType"
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Array of role assignments to create."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type of a storage container."
-                              }
-                            },
-                            "diagnosticSettingFullType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the diagnostic setting."
-                                  }
-                                },
-                                "logCategoriesAndGroups": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                        }
-                                      },
-                                      "categoryGroup": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                  }
-                                },
-                                "metricCategories": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "metadata": {
-                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                  }
-                                },
-                                "logAnalyticsDestinationType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "AzureDiagnostics",
-                                    "Dedicated"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                  }
-                                },
-                                "workspaceResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "storageAccountResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "eventHubAuthorizationRuleResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                  }
-                                },
-                                "eventHubName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "marketplacePartnerResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                }
-                              }
-                            },
-                            "immutabilityPolicyType": {
-                              "type": "object",
-                              "properties": {
-                                "immutabilityPeriodSinceCreationInDays": {
-                                  "type": "int",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                  }
-                                },
-                                "allowProtectedAppendWrites": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                                  }
-                                },
-                                "allowProtectedAppendWritesAll": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "The type for an immutability policy.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "container/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "automaticSnapshotPolicyEnabled": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Automatic Snapshot is enabled if set to true."
-                              }
-                            },
-                            "changeFeedEnabled": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
-                              }
-                            },
-                            "changeFeedRetentionInDays": {
-                              "type": "int",
-                              "nullable": true,
-                              "minValue": 1,
-                              "maxValue": 146000,
-                              "metadata": {
-                                "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
-                              }
-                            },
-                            "containerDeleteRetentionPolicyEnabled": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
-                              }
-                            },
-                            "containerDeleteRetentionPolicyDays": {
-                              "type": "int",
-                              "nullable": true,
-                              "minValue": 1,
-                              "maxValue": 365,
-                              "metadata": {
-                                "description": "Optional. Indicates the number of days that the deleted item should be retained."
-                              }
-                            },
-                            "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                              }
-                            },
-                            "corsRules": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/corsRuleType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                              }
-                            },
-                            "defaultServiceVersion": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
-                              }
-                            },
-                            "deleteRetentionPolicyEnabled": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. The blob service properties for blob soft delete."
-                              }
-                            },
-                            "deleteRetentionPolicyDays": {
-                              "type": "int",
-                              "defaultValue": 7,
-                              "minValue": 1,
-                              "maxValue": 365,
-                              "metadata": {
-                                "description": "Optional. Indicates the number of days that the deleted blob should be retained."
-                              }
-                            },
-                            "deleteRetentionPolicyAllowPermanentDelete": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                              }
-                            },
-                            "isVersioningEnabled": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
-                              }
-                            },
-                            "lastAccessTimeTrackingPolicyEnabled": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
-                              }
-                            },
-                            "restorePolicyEnabled": {
-                              "type": "bool",
-                              "defaultValue": false,
-                              "metadata": {
-                                "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
-                              }
-                            },
-                            "restorePolicyDays": {
-                              "type": "int",
-                              "defaultValue": 7,
-                              "minValue": 1,
-                              "metadata": {
-                                "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
-                              }
-                            },
-                            "containers": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/containerType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Blob containers to create."
-                              }
-                            },
-                            "diagnosticSettings": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/diagnosticSettingFullType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The diagnostic settings of the service."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "enableReferencedModulesTelemetry": false,
-                            "name": "default"
-                          },
-                          "resources": {
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2025-01-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "blobServices": {
-                              "type": "Microsoft.Storage/storageAccounts/blobServices",
-                              "apiVersion": "2025-01-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                              "properties": {
-                                "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
-                                "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
-                                "containerDeleteRetentionPolicy": {
-                                  "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
-                                  "days": "[parameters('containerDeleteRetentionPolicyDays')]",
-                                  "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
-                                },
-                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
-                                "defaultServiceVersion": "[parameters('defaultServiceVersion')]",
-                                "deleteRetentionPolicy": {
-                                  "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
-                                  "days": "[parameters('deleteRetentionPolicyDays')]",
-                                  "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
-                                },
-                                "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
-                                "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
-                                "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
-                              },
-                              "dependsOn": [
-                                "storageAccount"
-                              ]
-                            },
-                            "blobServices_diagnosticSettings": {
-                              "copy": {
-                                "name": "blobServices_diagnosticSettings",
-                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                              },
-                              "type": "Microsoft.Insights/diagnosticSettings",
-                              "apiVersion": "2021-05-01-preview",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "metrics",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                    "input": {
-                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                      "timeGrain": null
-                                    }
-                                  },
-                                  {
-                                    "name": "logs",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                    "input": {
-                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                    }
-                                  }
-                                ],
-                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                              },
-                              "dependsOn": [
-                                "blobServices"
-                              ]
-                            },
-                            "blobServices_container": {
-                              "copy": {
-                                "name": "blobServices_container",
-                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountName')]"
-                                  },
-                                  "blobServiceName": {
-                                    "value": "[variables('name')]"
-                                  },
-                                  "name": {
-                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
-                                  },
-                                  "defaultEncryptionScope": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
-                                  },
-                                  "denyEncryptionScopeOverride": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
-                                  },
-                                  "enableNfsV3AllSquash": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
-                                  },
-                                  "enableNfsV3RootSquash": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
-                                  },
-                                  "immutableStorageWithVersioningEnabled": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
-                                  },
-                                  "metadata": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
-                                  },
-                                  "publicAccess": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
-                                  },
-                                  "immutabilityPolicy": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "5026123498979497429"
-                                    },
-                                    "name": "Storage Account Blob Containers",
-                                    "description": "This module deploys a Storage Account Blob Container."
-                                  },
-                                  "definitions": {
-                                    "immutabilityPolicyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "immutabilityPeriodSinceCreationInDays": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                          }
-                                        },
-                                        "allowProtectedAppendWrites": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                                          }
-                                        },
-                                        "allowProtectedAppendWritesAll": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for an immutability policy."
-                                      }
-                                    },
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "blobServiceName": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the Storage Container to deploy."
-                                      }
-                                    },
-                                    "defaultEncryptionScope": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Default the container to use specified encryption scope for all writes."
-                                      }
-                                    },
-                                    "denyEncryptionScopeOverride": {
-                                      "type": "bool",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Block override of encryption scope from the container default."
-                                      }
-                                    },
-                                    "enableNfsV3AllSquash": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Enable NFSv3 all squash on blob container."
-                                      }
-                                    },
-                                    "enableNfsV3RootSquash": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Enable NFSv3 root squash on blob container."
-                                      }
-                                    },
-                                    "immutableStorageWithVersioningEnabled": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                                      }
-                                    },
-                                    "immutabilityPolicy": {
-                                      "$ref": "#/definitions/immutabilityPolicyType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configure immutability policy."
-                                      }
-                                    },
-                                    "metadata": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
-                                        },
-                                        "description": "Optional. A name-value pair to associate with the container as metadata."
-                                      },
-                                      "defaultValue": {}
-                                    },
-                                    "publicAccess": {
-                                      "type": "string",
-                                      "defaultValue": "None",
-                                      "allowedValues": [
-                                        "Container",
-                                        "Blob",
-                                        "None"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
-                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "storageAccount::blobServices": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts/blobServices",
-                                      "apiVersion": "2025-01-01",
-                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]"
-                                    },
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "storageAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts",
-                                      "apiVersion": "2025-01-01",
-                                      "name": "[parameters('storageAccountName')]"
-                                    },
-                                    "container": {
-                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
-                                      "apiVersion": "2025-01-01",
-                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
-                                      "properties": {
-                                        "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]",
-                                        "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]",
-                                        "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
-                                        "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
-                                        "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
-                                        "metadata": "[parameters('metadata')]",
-                                        "publicAccess": "[parameters('publicAccess')]"
-                                      }
-                                    },
-                                    "container_roleAssignments": {
-                                      "copy": {
-                                        "name": "container_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "container"
-                                      ]
-                                    },
-                                    "container_immutabilityPolicy": {
-                                      "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('storageAccountName')]"
-                                          },
-                                          "containerName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "immutabilityPeriodSinceCreationInDays": {
-                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]"
-                                          },
-                                          "allowProtectedAppendWrites": {
-                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]"
-                                          },
-                                          "allowProtectedAppendWritesAll": {
-                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "10782942397325758470"
-                                            },
-                                            "name": "Storage Account Blob Container Immutability Policies",
-                                            "description": "This module deploys a Storage Account Blob Container Immutability Policy."
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "containerName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "immutabilityPeriodSinceCreationInDays": {
-                                              "type": "int",
-                                              "defaultValue": 365,
-                                              "metadata": {
-                                                "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                              }
-                                            },
-                                            "allowProtectedAppendWrites": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                              }
-                                            },
-                                            "allowProtectedAppendWritesAll": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "name": "default"
-                                          },
-                                          "resources": [
-                                            {
-                                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
-                                              "apiVersion": "2025-01-01",
-                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]",
-                                              "properties": {
-                                                "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
-                                                "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
-                                                "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
-                                              }
-                                            }
-                                          ],
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed immutability policy."
-                                              },
-                                              "value": "[variables('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed immutability policy."
-                                              },
-                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group of the deployed immutability policy."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "container"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the deployed container."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the deployed container."
-                                      },
-                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group of the deployed container."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "blobServices"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed blob service."
-                              },
-                              "value": "[variables('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed blob service."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed blob service."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_fileServices": {
-                      "condition": "[not(empty(parameters('fileServices')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "diagnosticSettings": {
-                            "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
-                          },
-                          "protocolSettings": {
-                            "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
-                          },
-                          "shareDeleteRetentionPolicy": {
-                            "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
-                          },
-                          "shares": {
-                            "value": "[tryGet(parameters('fileServices'), 'shares')]"
-                          },
-                          "corsRules": {
-                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "2735186993322606805"
-                            },
-                            "name": "Storage Account File Share Services",
-                            "description": "This module deploys a Storage Account File Share Service."
-                          },
-                          "definitions": {
-                            "corsRuleType": {
-                              "type": "object",
-                              "properties": {
-                                "allowedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                  }
-                                },
-                                "allowedMethods": {
-                                  "type": "array",
-                                  "allowedValues": [
-                                    "CONNECT",
-                                    "DELETE",
-                                    "GET",
-                                    "HEAD",
-                                    "MERGE",
-                                    "OPTIONS",
-                                    "PATCH",
-                                    "POST",
-                                    "PUT",
-                                    "TRACE"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                  }
-                                },
-                                "allowedOrigins": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                  }
-                                },
-                                "exposedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                  }
-                                },
-                                "maxAgeInSeconds": {
-                                  "type": "int",
-                                  "metadata": {
-                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for a cors rule."
-                              }
-                            },
-                            "diagnosticSettingFullType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the diagnostic setting."
-                                  }
-                                },
-                                "logCategoriesAndGroups": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                        }
-                                      },
-                                      "categoryGroup": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                  }
-                                },
-                                "metricCategories": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "metadata": {
-                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                  }
-                                },
-                                "logAnalyticsDestinationType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "AzureDiagnostics",
-                                    "Dedicated"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                  }
-                                },
-                                "workspaceResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "storageAccountResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "eventHubAuthorizationRuleResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                  }
-                                },
-                                "eventHubName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "marketplacePartnerResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "default",
-                              "metadata": {
-                                "description": "Optional. The name of the file service."
-                              }
-                            },
-                            "protocolSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
-                                },
-                                "description": "Optional. Protocol settings for file service."
-                              },
-                              "defaultValue": {}
-                            },
-                            "shareDeleteRetentionPolicy": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
-                                },
-                                "description": "Optional. The service properties for soft delete."
-                              },
-                              "defaultValue": {
-                                "enabled": true,
-                                "days": 7
-                              }
-                            },
-                            "corsRules": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/corsRuleType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                              }
-                            },
-                            "diagnosticSettings": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/diagnosticSettingFullType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The diagnostic settings of the service."
-                              }
-                            },
-                            "shares": {
-                              "type": "array",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. File shares to create."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "enableReferencedModulesTelemetry": false
-                          },
-                          "resources": {
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2024-01-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "fileServices": {
-                              "type": "Microsoft.Storage/storageAccounts/fileServices",
-                              "apiVersion": "2024-01-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
-                              "properties": {
-                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
-                                "protocolSettings": "[parameters('protocolSettings')]",
-                                "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
-                              }
-                            },
-                            "fileServices_diagnosticSettings": {
-                              "copy": {
-                                "name": "fileServices_diagnosticSettings",
-                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                              },
-                              "type": "Microsoft.Insights/diagnosticSettings",
-                              "apiVersion": "2021-05-01-preview",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "metrics",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                    "input": {
-                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                      "timeGrain": null
-                                    }
-                                  },
-                                  {
-                                    "name": "logs",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                    "input": {
-                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                    }
-                                  }
-                                ],
-                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                              },
-                              "dependsOn": [
-                                "fileServices"
-                              ]
-                            },
-                            "fileServices_shares": {
-                              "copy": {
-                                "name": "fileServices_shares",
-                                "count": "[length(coalesce(parameters('shares'), createArray()))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountName')]"
-                                  },
-                                  "fileServicesName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "name": {
-                                    "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
-                                  },
-                                  "accessTier": {
-                                    "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]"
-                                  },
-                                  "enabledProtocols": {
-                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
-                                  },
-                                  "rootSquash": {
-                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
-                                  },
-                                  "shareQuota": {
-                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "15881640847294537074"
-                                    },
-                                    "name": "Storage Account File Shares",
-                                    "description": "This module deploys a Storage Account File Share."
-                                  },
-                                  "definitions": {
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "fileServicesName": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the file share to create."
-                                      }
-                                    },
-                                    "accessTier": {
-                                      "type": "string",
-                                      "defaultValue": "TransactionOptimized",
-                                      "allowedValues": [
-                                        "Premium",
-                                        "Hot",
-                                        "Cool",
-                                        "TransactionOptimized"
-                                      ],
-                                      "metadata": {
-                                        "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
-                                      }
-                                    },
-                                    "shareQuota": {
-                                      "type": "int",
-                                      "defaultValue": 5120,
-                                      "metadata": {
-                                        "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
-                                      }
-                                    },
-                                    "enabledProtocols": {
-                                      "type": "string",
-                                      "defaultValue": "SMB",
-                                      "allowedValues": [
-                                        "NFS",
-                                        "SMB"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
-                                      }
-                                    },
-                                    "rootSquash": {
-                                      "type": "string",
-                                      "defaultValue": "NoRootSquash",
-                                      "allowedValues": [
-                                        "AllSquash",
-                                        "NoRootSquash",
-                                        "RootSquash"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
-                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
-                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "storageAccount::fileService": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts/fileServices",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]"
-                                    },
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "storageAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[parameters('storageAccountName')]"
-                                    },
-                                    "fileShare": {
-                                      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
-                                      "properties": {
-                                        "accessTier": "[parameters('accessTier')]",
-                                        "shareQuota": "[parameters('shareQuota')]",
-                                        "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
-                                        "enabledProtocols": "[parameters('enabledProtocols')]"
-                                      }
-                                    },
-                                    "fileShare_roleAssignments": {
-                                      "copy": {
-                                        "name": "fileShare_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "scope": {
-                                            "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]"
-                                          },
-                                          "name": {
-                                            "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]"
-                                          },
-                                          "roleDefinitionId": {
-                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
-                                          },
-                                          "principalId": {
-                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
-                                          },
-                                          "principalType": {
-                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
-                                          },
-                                          "condition": {
-                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]"
-                                          },
-                                          "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]",
-                                          "delegatedManagedIdentityResourceId": {
-                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                          },
-                                          "description": {
-                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "parameters": {
-                                            "scope": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The scope to deploy the role assignment to."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the role assignment."
-                                              }
-                                            },
-                                            "roleDefinitionId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The role definition Id to assign."
-                                              }
-                                            },
-                                            "principalId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                              }
-                                            },
-                                            "principalType": {
-                                              "type": "string",
-                                              "allowedValues": [
-                                                "Device",
-                                                "ForeignGroup",
-                                                "Group",
-                                                "ServicePrincipal",
-                                                "User",
-                                                ""
-                                              ],
-                                              "defaultValue": "",
-                                              "metadata": {
-                                                "description": "Optional. The principal type of the assigned principal ID."
-                                              }
-                                            },
-                                            "description": {
-                                              "type": "string",
-                                              "defaultValue": "",
-                                              "metadata": {
-                                                "description": "Optional. The description of the role assignment."
-                                              }
-                                            },
-                                            "condition": {
-                                              "type": "string",
-                                              "defaultValue": "",
-                                              "metadata": {
-                                                "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
-                                              }
-                                            },
-                                            "conditionVersion": {
-                                              "type": "string",
-                                              "allowedValues": [
-                                                "2.0"
-                                              ],
-                                              "defaultValue": "2.0",
-                                              "metadata": {
-                                                "description": "Optional. Version of the condition."
-                                              }
-                                            },
-                                            "delegatedManagedIdentityResourceId": {
-                                              "type": "string",
-                                              "defaultValue": "",
-                                              "metadata": {
-                                                "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                              }
-                                            }
-                                          },
-                                          "resources": [
-                                            {
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[parameters('scope')]",
-                                              "name": "[parameters('name')]",
-                                              "properties": {
-                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                                "principalId": "[parameters('principalId')]",
-                                                "description": "[parameters('description')]",
-                                                "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
-                                                "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
-                                                "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
-                                              }
-                                            }
-                                          ]
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "fileShare"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the deployed file share."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the deployed file share."
-                                      },
-                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group of the deployed file share."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "fileServices",
-                                "storageAccount"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed file share service."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed file share service."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed file share service."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_queueServices": {
-                      "condition": "[not(empty(parameters('queueServices')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "diagnosticSettings": {
-                            "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
-                          },
-                          "queues": {
-                            "value": "[tryGet(parameters('queueServices'), 'queues')]"
-                          },
-                          "corsRules": {
-                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "1100093319443502715"
-                            },
-                            "name": "Storage Account Queue Services",
-                            "description": "This module deploys a Storage Account Queue Service."
-                          },
-                          "definitions": {
-                            "corsRuleType": {
-                              "type": "object",
-                              "properties": {
-                                "allowedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                  }
-                                },
-                                "allowedMethods": {
-                                  "type": "array",
-                                  "allowedValues": [
-                                    "CONNECT",
-                                    "DELETE",
-                                    "GET",
-                                    "HEAD",
-                                    "MERGE",
-                                    "OPTIONS",
-                                    "PATCH",
-                                    "POST",
-                                    "PUT",
-                                    "TRACE"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                  }
-                                },
-                                "allowedOrigins": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                  }
-                                },
-                                "exposedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                  }
-                                },
-                                "maxAgeInSeconds": {
-                                  "type": "int",
-                                  "metadata": {
-                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for a cors rule."
-                              }
-                            },
-                            "diagnosticSettingFullType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the diagnostic setting."
-                                  }
-                                },
-                                "logCategoriesAndGroups": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                        }
-                                      },
-                                      "categoryGroup": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                  }
-                                },
-                                "metricCategories": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "metadata": {
-                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                  }
-                                },
-                                "logAnalyticsDestinationType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "AzureDiagnostics",
-                                    "Dedicated"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                  }
-                                },
-                                "workspaceResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "storageAccountResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "eventHubAuthorizationRuleResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                  }
-                                },
-                                "eventHubName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "marketplacePartnerResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "queues": {
-                              "type": "array",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Queues to create."
-                              }
-                            },
-                            "corsRules": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/corsRuleType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                              }
-                            },
-                            "diagnosticSettings": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/diagnosticSettingFullType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The diagnostic settings of the service."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "name": "default"
-                          },
-                          "resources": {
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2024-01-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "queueServices": {
-                              "type": "Microsoft.Storage/storageAccounts/queueServices",
-                              "apiVersion": "2024-01-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                              "properties": {
-                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
-                              }
-                            },
-                            "queueServices_diagnosticSettings": {
-                              "copy": {
-                                "name": "queueServices_diagnosticSettings",
-                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                              },
-                              "type": "Microsoft.Insights/diagnosticSettings",
-                              "apiVersion": "2021-05-01-preview",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "metrics",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                    "input": {
-                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                      "timeGrain": null
-                                    }
-                                  },
-                                  {
-                                    "name": "logs",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                    "input": {
-                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                    }
-                                  }
-                                ],
-                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                              },
-                              "dependsOn": [
-                                "queueServices"
-                              ]
-                            },
-                            "queueServices_queues": {
-                              "copy": {
-                                "name": "queueServices_queues",
-                                "count": "[length(coalesce(parameters('queues'), createArray()))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountName')]"
-                                  },
-                                  "name": {
-                                    "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
-                                  },
-                                  "metadata": {
-                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "17963799770990303971"
-                                    },
-                                    "name": "Storage Account Queues",
-                                    "description": "This module deploys a Storage Account Queue."
-                                  },
-                                  "definitions": {
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the storage queue to deploy."
-                                      }
-                                    },
-                                    "metadata": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
-                                        },
-                                        "description": "Optional. A name-value pair that represents queue metadata."
-                                      },
-                                      "defaultValue": {}
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
-                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
-                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "storageAccount::queueServices": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts/queueServices",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
-                                    },
-                                    "storageAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[parameters('storageAccountName')]"
-                                    },
-                                    "queue": {
-                                      "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                                      "properties": {
-                                        "metadata": "[parameters('metadata')]"
-                                      }
-                                    },
-                                    "queue_roleAssignments": {
-                                      "copy": {
-                                        "name": "queue_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "queue"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the deployed queue."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the deployed queue."
-                                      },
-                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group of the deployed queue."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed file share service."
-                              },
-                              "value": "[variables('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed file share service."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed file share service."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "storageAccount_tableServices": {
-                      "condition": "[not(empty(parameters('tableServices')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "storageAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "diagnosticSettings": {
-                            "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
-                          },
-                          "tables": {
-                            "value": "[tryGet(parameters('tableServices'), 'tables')]"
-                          },
-                          "corsRules": {
-                            "value": "[tryGet(parameters('tableServices'), 'corsRules')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "13069389074590786512"
-                            },
-                            "name": "Storage Account Table Services",
-                            "description": "This module deploys a Storage Account Table Service."
-                          },
-                          "definitions": {
-                            "corsRuleType": {
-                              "type": "object",
-                              "properties": {
-                                "allowedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                  }
-                                },
-                                "allowedMethods": {
-                                  "type": "array",
-                                  "allowedValues": [
-                                    "CONNECT",
-                                    "DELETE",
-                                    "GET",
-                                    "HEAD",
-                                    "MERGE",
-                                    "OPTIONS",
-                                    "PATCH",
-                                    "POST",
-                                    "PUT",
-                                    "TRACE"
-                                  ],
-                                  "metadata": {
-                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                  }
-                                },
-                                "allowedOrigins": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                  }
-                                },
-                                "exposedHeaders": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                  }
-                                },
-                                "maxAgeInSeconds": {
-                                  "type": "int",
-                                  "metadata": {
-                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for a cors rule."
-                              }
-                            },
-                            "diagnosticSettingFullType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the diagnostic setting."
-                                  }
-                                },
-                                "logCategoriesAndGroups": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                        }
-                                      },
-                                      "categoryGroup": {
-                                        "type": "string",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                  }
-                                },
-                                "metricCategories": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "object",
-                                    "properties": {
-                                      "category": {
-                                        "type": "string",
-                                        "metadata": {
-                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                        }
-                                      },
-                                      "enabled": {
-                                        "type": "bool",
-                                        "nullable": true,
-                                        "metadata": {
-                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                  }
-                                },
-                                "logAnalyticsDestinationType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "AzureDiagnostics",
-                                    "Dedicated"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                  }
-                                },
-                                "workspaceResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "storageAccountResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "eventHubAuthorizationRuleResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                  }
-                                },
-                                "eventHubName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                  }
-                                },
-                                "marketplacePartnerResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "storageAccountName": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "tables": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. tables to create."
-                              }
-                            },
-                            "corsRules": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/corsRuleType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                              }
-                            },
-                            "diagnosticSettings": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/diagnosticSettingFullType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The diagnostic settings of the service."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "name": "default"
-                          },
-                          "resources": {
-                            "storageAccount": {
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2024-01-01",
-                              "name": "[parameters('storageAccountName')]"
-                            },
-                            "tableServices": {
-                              "type": "Microsoft.Storage/storageAccounts/tableServices",
-                              "apiVersion": "2024-01-01",
-                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                              "properties": {
-                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
-                              }
-                            },
-                            "tableServices_diagnosticSettings": {
-                              "copy": {
-                                "name": "tableServices_diagnosticSettings",
-                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                              },
-                              "type": "Microsoft.Insights/diagnosticSettings",
-                              "apiVersion": "2021-05-01-preview",
-                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "metrics",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                    "input": {
-                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                      "timeGrain": null
-                                    }
-                                  },
-                                  {
-                                    "name": "logs",
-                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                    "input": {
-                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                    }
-                                  }
-                                ],
-                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                              },
-                              "dependsOn": [
-                                "tableServices"
-                              ]
-                            },
-                            "tableServices_tables": {
-                              "copy": {
-                                "name": "tableServices_tables",
-                                "count": "[length(parameters('tables'))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('tables')[copyIndex()].name]"
-                                  },
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountName')]"
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "10905926757212375091"
-                                    },
-                                    "name": "Storage Account Table",
-                                    "description": "This module deploys a Storage Account Table."
-                                  },
-                                  "definitions": {
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Name of the table."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
-                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "storageAccount::tableServices": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts/tableServices",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
-                                    },
-                                    "storageAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.Storage/storageAccounts",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[parameters('storageAccountName')]"
-                                    },
-                                    "table": {
-                                      "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]"
-                                    },
-                                    "table_roleAssignments": {
-                                      "copy": {
-                                        "name": "table_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "table"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the deployed file share service."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the deployed file share service."
-                                      },
-                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group of the deployed file share service."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the deployed table service."
-                              },
-                              "value": "[variables('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the deployed table service."
-                              },
-                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group of the deployed table service."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    },
-                    "secretsExport": {
-                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
-                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "keyVaultName": {
-                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
-                          },
-                          "secretsToSet": {
-                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "9368972709899985618"
-                            }
-                          },
-                          "definitions": {
-                            "secretSetOutputType": {
-                              "type": "object",
-                              "properties": {
-                                "secretResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "The resourceId of the exported secret."
-                                  }
-                                },
-                                "secretUri": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "The secret URI of the exported secret."
-                                  }
-                                },
-                                "secretUriWithVersion": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "The secret URI with version of the exported secret."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            },
-                            "secretToSetType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the secret to set."
-                                  }
-                                },
-                                "value": {
-                                  "type": "securestring",
-                                  "metadata": {
-                                    "description": "Required. The value of the secret to set."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "keyVaultName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the Key Vault to set the ecrets in."
-                              }
-                            },
-                            "secretsToSet": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/secretToSetType"
-                              },
-                              "metadata": {
-                                "description": "Required. The secrets to set in the Key Vault."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "keyVault": {
-                              "existing": true,
-                              "type": "Microsoft.KeyVault/vaults",
-                              "apiVersion": "2024-11-01",
-                              "name": "[parameters('keyVaultName')]"
-                            },
-                            "secrets": {
-                              "copy": {
-                                "name": "secrets",
-                                "count": "[length(parameters('secretsToSet'))]"
-                              },
-                              "type": "Microsoft.KeyVault/vaults/secrets",
-                              "apiVersion": "2024-11-01",
-                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
-                              "properties": {
-                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "secretsSet": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/secretSetOutputType"
-                              },
-                              "metadata": {
-                                "description": "The references to the secrets exported to the provided Key Vault."
-                              },
-                              "copy": {
-                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
-                                "input": {
-                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
-                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
-                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
-                                }
-                              }
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "storageAccount"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the deployed storage account."
-                      },
-                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the deployed storage account."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group of the deployed storage account."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "primaryBlobEndpoint": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The primary blob endpoint reference if blob services are deployed."
-                      },
-                      "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('storageAccount', '2024-01-01', 'full').location]"
-                    },
-                    "serviceEndpoints": {
-                      "type": "object",
-                      "metadata": {
-                        "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
-                      },
-                      "value": "[reference('storageAccount').primaryEndpoints]"
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the Storage Account."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                        }
-                      }
-                    },
-                    "exportedSecrets": {
-                      "$ref": "#/definitions/secretsOutputType",
-                      "metadata": {
-                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
-                      },
-                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
-                    },
-                    "primaryAccessKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary access key of the storage account."
-                      },
-                      "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]"
-                    },
-                    "secondaryAccessKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary access key of the storage account."
-                      },
-                      "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]"
-                    },
-                    "primaryConnectionString": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary connection string of the storage account."
-                      },
-                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]"
-                    },
-                    "secondaryConnectionString": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary connection string of the storage account."
-                      },
-                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('storageAccount').outputs.resourceId.value]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[format('{0}.storageAccount', deployment().name)]"
-            },
-            "primaryBlobEndpoint": {
-              "type": "string",
-              "value": "[reference('storageAccount').outputs.primaryBlobEndpoint.value]"
-            },
-            "primaryQueueEndpoint": {
-              "type": "string",
-              "value": "[format('https://{0}.queue.{1}/', reference('storageAccount').outputs.name.value, environment().suffixes.storage)]"
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "value": "[reference('storageAccount').outputs.privateEndpoints.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalytics",
-        "queueDnsZone",
-        "userAssignedIdentity"
-      ]
-    },
-    "cosmos": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('cosmos-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "location": {
-            "value": "[parameters('cosmosLocation')]"
-          },
-          "cosmosAccountName": {
-            "value": "[variables('cosmosAccountName')]"
-          },
-          "cosmosDbName": {
-            "value": "[parameters('cosmosDbName')]"
-          },
-          "cosmosDBContainerNames": {
-            "value": "[parameters('cosmosDBContainerNames')]"
-          },
-          "cosmosDBDataContributorPrincipalIds": "[if(not(empty(parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value, parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value)))]",
-          "zoneRedundant": {
-            "value": false
-          },
-          "enablePrivateEndpoint": {
-            "value": "[variables('isAILZIntegrated')]"
-          },
-          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
-          "cosmosPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.cosmos), createObject('value', ''))]",
-          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "3202396039492631389"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "Location for cosmos DB resources"
-              }
-            },
-            "cosmosAccountName": {
-              "type": "string",
-              "metadata": {
-                "description": "Required: Cosmos DB account name"
-              }
-            },
-            "cosmosDbName": {
-              "type": "string",
-              "metadata": {
-                "description": "Required: Cosmos DB database name"
-              }
-            },
-            "cosmosDBContainerNames": {
-              "type": "array",
-              "metadata": {
-                "description": "Required: Cosmos DB container names used in the application"
-              }
-            },
-            "cosmosDBDataContributorPrincipalIds": {
-              "type": "array",
-              "metadata": {
-                "description": "Required: List of principal IDs (managed identity or user) to be assigned Cosmos DB SQL Data Contributor role"
-              }
-            },
-            "zoneRedundant": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional: Enable zone redundancy for Cosmos DB account. Defaults to false."
-              }
-            },
-            "enablePrivateEndpoint": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional: Enable private endpoint for AILZ integrated mode. Defaults to false."
-              }
-            },
-            "privateEndpointSubnetId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional: Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "cosmosPrivateDnsZoneId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Optional: Cosmos DB Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Optional: Public network access setting (used in AILZ integrated mode). Defaults to Enabled."
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional: Tags for resources"
-              }
-            }
-          },
-          "resources": {
-            "cosmosAccount": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}.cosmosAccount', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('cosmosAccountName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "capabilitiesToAdd": {
-                    "value": [
-                      "EnableServerless"
-                    ]
-                  },
-                  "databaseAccountOfferType": {
-                    "value": "Standard"
-                  },
-                  "disableLocalAuthentication": {
-                    "value": true
-                  },
-                  "automaticFailover": {
-                    "value": false
-                  },
-                  "enableMultipleWriteLocations": {
-                    "value": false
-                  },
-                  "enableFreeTier": {
-                    "value": false
-                  },
-                  "defaultConsistencyLevel": {
-                    "value": "Session"
-                  },
-                  "backupPolicyContinuousTier": {
-                    "value": "Continuous7Days"
-                  },
-                  "networkRestrictions": {
-                    "value": {
-                      "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
-                      "networkAclBypass": "AzureServices",
-                      "ipRules": []
-                    }
-                  },
-                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-pe', parameters('cosmosAccountName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'Sql', 'privateLinkServiceConnectionName', format('{0}-cosmos-plsc', parameters('cosmosAccountName')), 'privateDnsZoneGroup', if(not(empty(parameters('cosmosPrivateDnsZoneId'))), createObject('name', 'cosmos-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'cosmos-config', 'privateDnsZoneResourceId', parameters('cosmosPrivateDnsZoneId')))), null())))), createObject('value', createArray()))]",
-                  "zoneRedundant": {
-                    "value": "[parameters('zoneRedundant')]"
-                  },
-                  "sqlDatabases": {
-                    "value": [
-                      {
-                        "copy": [
-                          {
-                            "name": "containers",
-                            "count": "[length(parameters('cosmosDBContainerNames'))]",
-                            "input": {
-                              "name": "[parameters('cosmosDBContainerNames')[copyIndex('containers')].name]",
-                              "paths": [
-                                "[parameters('cosmosDBContainerNames')[copyIndex('containers')].partitionKey]"
-                              ],
-                              "kind": "Hash"
-                            }
-                          }
-                        ],
-                        "name": "[parameters('cosmosDbName')]"
-                      }
-                    ]
-                  },
-                  "dataPlaneRoleDefinitions": {
-                    "value": [
-                      {
-                        "copy": [
-                          {
-                            "name": "assignments",
-                            "count": "[length(parameters('cosmosDBDataContributorPrincipalIds'))]",
-                            "input": {
-                              "principalId": "[parameters('cosmosDBDataContributorPrincipalIds')[copyIndex('assignments')]]"
-                            }
-                          }
-                        ],
-                        "roleName": "Cosmos DB SQL Data Contributor",
-                        "dataActions": [
-                          "Microsoft.DocumentDB/databaseAccounts/readMetadata",
-                          "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/*",
-                          "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers/items/*"
-                        ]
-                      }
-                    ]
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.37.4.10188",
-                      "templateHash": "17715929342484596741"
-                    },
-                    "name": "Azure Cosmos DB account",
-                    "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed."
-                  },
-                  "definitions": {
-                    "privateEndpointOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group ID for the private endpoint group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address."
-                                }
-                              },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses for the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the private endpoint output."
-                      }
-                    },
-                    "failoverLocationType": {
-                      "type": "object",
-                      "properties": {
-                        "failoverPriority": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
-                          }
-                        },
-                        "isZoneRedundant": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true."
-                          }
-                        },
-                        "locationName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the region."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the failover location."
-                      }
-                    },
-                    "dataPlaneRoleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The unique name of the role assignment."
-                          }
-                        },
-                        "roleDefinitionId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment."
-                      }
-                    },
-                    "dataPlaneRoleDefinitionType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The unique identifier of the role-based access control definition."
-                          }
-                        },
-                        "roleName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account."
-                          }
-                        },
-                        "dataActions": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. An array of data actions that are allowed."
-                          }
-                        },
-                        "assignableScopes": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope."
-                          }
-                        },
-                        "assignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/sqlRoleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. An array of role-based access control assignments to be created for the definition."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition."
-                      }
-                    },
-                    "sqlDatabaseType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the database ."
-                          }
-                        },
-                        "throughput": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400."
-                          }
-                        },
-                        "autoscaleSettingsMaxThroughput": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                          }
-                        },
-                        "containers": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of the container."
-                                }
-                              },
-                              "paths": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "minLength": 1,
-                                "maxLength": 3,
-                                "metadata": {
-                                  "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                                }
-                              },
-                              "analyticalStorageTtl": {
-                                "type": "int",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                                }
-                              },
-                              "autoscaleSettingsMaxThroughput": {
-                                "type": "int",
-                                "nullable": true,
-                                "maxValue": 1000000,
-                                "metadata": {
-                                  "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
-                                }
-                              },
-                              "conflictResolutionPolicy": {
-                                "type": "object",
-                                "properties": {
-                                  "conflictResolutionPath": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
-                                    }
-                                  },
-                                  "conflictResolutionProcedure": {
-                                    "type": "string",
-                                    "nullable": true,
-                                    "metadata": {
-                                      "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
-                                    }
-                                  },
-                                  "mode": {
-                                    "type": "string",
-                                    "allowedValues": [
-                                      "Custom",
-                                      "LastWriterWins"
-                                    ],
-                                    "metadata": {
-                                      "description": "Required. Indicates the conflict resolution mode."
-                                    }
-                                  }
-                                },
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                                }
-                              },
-                              "defaultTtl": {
-                                "type": "int",
-                                "nullable": true,
-                                "minValue": -1,
-                                "maxValue": 2147483647,
-                                "metadata": {
-                                  "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                                }
-                              },
-                              "indexingPolicy": {
-                                "type": "object",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Indexing policy of the container."
-                                }
-                              },
-                              "kind": {
-                                "type": "string",
-                                "allowedValues": [
-                                  "Hash",
-                                  "MultiHash"
-                                ],
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                                }
-                              },
-                              "version": {
-                                "type": "int",
-                                "allowedValues": [
-                                  1,
-                                  2
-                                ],
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                                }
-                              },
-                              "throughput": {
-                                "type": "int",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
-                                }
-                              },
-                              "uniqueKeyPolicyKeys": {
-                                "type": "array",
-                                "items": {
-                                  "type": "object",
-                                  "properties": {
-                                    "paths": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "metadata": {
-                                        "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
-                                      }
-                                    }
-                                  }
-                                },
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Set of containers to deploy in the database."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an Azure Cosmos DB for NoSQL database."
-                      }
-                    },
-                    "networkRestrictionType": {
-                      "type": "object",
-                      "properties": {
-                        "ipRules": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`."
-                          }
-                        },
-                        "networkAclBypass": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureServices",
-                            "None"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"."
-                          }
-                        },
-                        "publicNetworkAccess": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Disabled",
-                            "Enabled"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"."
-                          }
-                        },
-                        "virtualNetworkRules": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "subnetResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Resource ID of a subnet."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. List of virtual network access control list (ACL) rules configured for the account."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the network restriction."
-                      }
-                    },
-                    "_1.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                }
-                              },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "privateEndpointMultiServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private endpoint."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location to deploy the private endpoint to."
-                          }
-                        },
-                        "privateLinkServiceConnectionName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private link connection to create."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
-                          }
-                        },
-                        "subnetResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                          }
-                        },
-                        "resourceGroupResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                          }
-                        },
-                        "privateDnsZoneGroup": {
-                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                          }
-                        },
-                        "isManualConnection": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. If Manual Private Link Connection is required."
-                          }
-                        },
-                        "manualConnectionRequestMessage": {
-                          "type": "string",
-                          "nullable": true,
-                          "maxLength": 140,
-                          "metadata": {
-                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom DNS configurations."
-                          }
-                        },
-                        "ipConfigurations": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                          }
-                        },
-                        "applicationSecurityGroupResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                          }
-                        },
-                        "customNetworkInterfaceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                          }
-                        },
-                        "lock": {
-                          "$ref": "#/definitions/lockType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                            },
-                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                          }
-                        },
-                        "enableTelemetry": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable/Disable usage telemetry for module."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "sqlRoleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for the SQL Role Assignments.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "sql-role-definition/main.bicep"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. The name of the account."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Defaults to the current resource group scope location. Location for all resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags"
-                        },
-                        "description": "Optional. Tags for the resource."
-                      },
-                      "nullable": true
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "databaseAccountOfferType": {
-                      "type": "string",
-                      "defaultValue": "Standard",
-                      "allowedValues": [
-                        "Standard"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The offer type for the account. Defaults to \"Standard\"."
-                      }
-                    },
-                    "failoverLocations": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/failoverLocationType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed."
-                      }
-                    },
-                    "zoneRedundant": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts."
-                      }
-                    },
-                    "defaultConsistencyLevel": {
-                      "type": "string",
-                      "defaultValue": "Session",
-                      "allowedValues": [
-                        "Eventual",
-                        "ConsistentPrefix",
-                        "Session",
-                        "BoundedStaleness",
-                        "Strong"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The default consistency level of the account. Defaults to \"Session\"."
-                      }
-                    },
-                    "disableLocalAuthentication": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true."
-                      }
-                    },
-                    "enableAnalyticalStorage": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false."
-                      }
-                    },
-                    "automaticFailover": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable automatic failover for regions. Defaults to true."
-                      }
-                    },
-                    "enableFreeTier": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false."
-                      }
-                    },
-                    "enableMultipleWriteLocations": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false."
-                      }
-                    },
-                    "disableKeyBasedMetadataWriteAccess": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true."
-                      }
-                    },
-                    "maxStalenessPrefix": {
-                      "type": "int",
-                      "defaultValue": 100000,
-                      "minValue": 1,
-                      "maxValue": 2147483647,
-                      "metadata": {
-                        "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000."
-                      }
-                    },
-                    "maxIntervalInSeconds": {
-                      "type": "int",
-                      "defaultValue": 300,
-                      "minValue": 5,
-                      "maxValue": 86400,
-                      "metadata": {
-                        "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300."
-                      }
-                    },
-                    "serverVersion": {
-                      "type": "string",
-                      "defaultValue": "4.2",
-                      "allowedValues": [
-                        "3.2",
-                        "3.6",
-                        "4.0",
-                        "4.2",
-                        "5.0",
-                        "6.0",
-                        "7.0"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"."
-                      }
-                    },
-                    "sqlDatabases": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/sqlDatabaseType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL."
-                      }
-                    },
-                    "mongodbDatabases": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU."
-                      }
-                    },
-                    "gremlinDatabases": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin."
-                      }
-                    },
-                    "tables": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "totalThroughputLimit": {
-                      "type": "int",
-                      "defaultValue": -1,
-                      "metadata": {
-                        "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. An array of control plane Azure role-based access control assignments."
-                      }
-                    },
-                    "dataPlaneRoleDefinitions": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/dataPlaneRoleDefinitionType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions."
-                      }
-                    },
-                    "dataPlaneRoleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/dataPlaneRoleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings for the service."
-                      }
-                    },
-                    "capabilitiesToAdd": {
-                      "type": "array",
-                      "items": {
-                        "type": "string"
-                      },
-                      "nullable": true,
-                      "allowedValues": [
-                        "EnableCassandra",
-                        "EnableTable",
-                        "EnableGremlin",
-                        "EnableMongo",
-                        "DisableRateLimitingResponses",
-                        "EnableServerless",
-                        "EnableNoSQLVectorSearch",
-                        "EnableNoSQLFullTextSearch",
-                        "EnableMaterializedViews",
-                        "DeleteAllItemsByPartitionKey"
-                      ],
-                      "metadata": {
-                        "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account."
-                      }
-                    },
-                    "backupPolicyType": {
-                      "type": "string",
-                      "defaultValue": "Continuous",
-                      "allowedValues": [
-                        "Periodic",
-                        "Continuous"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"."
-                      }
-                    },
-                    "backupPolicyContinuousTier": {
-                      "type": "string",
-                      "defaultValue": "Continuous30Days",
-                      "allowedValues": [
-                        "Continuous30Days",
-                        "Continuous7Days"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"."
-                      }
-                    },
-                    "backupIntervalInMinutes": {
-                      "type": "int",
-                      "defaultValue": 240,
-                      "minValue": 60,
-                      "maxValue": 1440,
-                      "metadata": {
-                        "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240."
-                      }
-                    },
-                    "backupRetentionIntervalInHours": {
-                      "type": "int",
-                      "defaultValue": 8,
-                      "minValue": 2,
-                      "maxValue": 720,
-                      "metadata": {
-                        "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8."
-                      }
-                    },
-                    "backupStorageRedundancy": {
-                      "type": "string",
-                      "defaultValue": "Local",
-                      "allowedValues": [
-                        "Geo",
-                        "Local",
-                        "Zone"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"."
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointMultiServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible."
-                      }
-                    },
-                    "networkRestrictions": {
-                      "$ref": "#/definitions/networkRestrictionType",
-                      "defaultValue": {
-                        "ipRules": [],
-                        "virtualNetworkRules": [],
-                        "publicNetworkAccess": "Disabled"
-                      },
-                      "metadata": {
-                        "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
-                      }
-                    },
-                    "minimumTlsVersion": {
-                      "type": "string",
-                      "defaultValue": "Tls12",
-                      "allowedValues": [
-                        "Tls12"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "enableReferencedModulesTelemetry": false,
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInControlPlaneRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
-                      "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
-                      "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
-                      "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
-                      "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-07-01",
-                      "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "databaseAccount": {
-                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                      "apiVersion": "2024-11-15",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "identity": "[variables('identity')]",
-                      "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]",
-                      "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]"
-                    },
-                    "databaseAccount_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_diagnosticSettings": {
-                      "copy": {
-                        "name": "databaseAccount_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_roleAssignments": {
-                      "copy": {
-                        "name": "databaseAccount_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_sqlDatabases": {
-                      "copy": {
-                        "name": "databaseAccount_sqlDatabases",
-                        "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]"
-                          },
-                          "containers": {
-                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]"
-                          },
-                          "throughput": {
-                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]"
-                          },
-                          "databaseAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "autoscaleSettingsMaxThroughput": {
-                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "7141543733238879531"
-                            },
-                            "name": "DocumentDB Database Account SQL Databases",
-                            "description": "This module deploys a SQL Database in a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the SQL database ."
-                              }
-                            },
-                            "containers": {
-                              "type": "array",
-                              "items": {
-                                "type": "object"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of containers to deploy in the SQL database."
-                              }
-                            },
-                            "throughput": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                              }
-                            },
-                            "autoscaleSettingsMaxThroughput": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the SQL database resource."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "sqlDatabase": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "resource": {
-                                  "id": "[parameters('name')]"
-                                },
-                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
-                              },
-                              "dependsOn": [
-                                "databaseAccount"
-                              ]
-                            },
-                            "container": {
-                              "copy": {
-                                "name": "container",
-                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "databaseAccountName": {
-                                    "value": "[parameters('databaseAccountName')]"
-                                  },
-                                  "sqlDatabaseName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "name": {
-                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
-                                  },
-                                  "analyticalStorageTtl": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]"
-                                  },
-                                  "autoscaleSettingsMaxThroughput": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
-                                  },
-                                  "conflictResolutionPolicy": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]"
-                                  },
-                                  "defaultTtl": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]"
-                                  },
-                                  "indexingPolicy": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]"
-                                  },
-                                  "kind": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]"
-                                  },
-                                  "version": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]"
-                                  },
-                                  "paths": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]"
-                                  },
-                                  "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]",
-                                  "uniqueKeyPolicyKeys": {
-                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "1789954443166349986"
-                                    },
-                                    "name": "DocumentDB Database Account SQL Database Containers",
-                                    "description": "This module deploys a SQL Database Container in a CosmosDB Account."
-                                  },
-                                  "parameters": {
-                                    "databaseAccountName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "sqlDatabaseName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Name of the container."
-                                      }
-                                    },
-                                    "analyticalStorageTtl": {
-                                      "type": "int",
-                                      "defaultValue": 0,
-                                      "metadata": {
-                                        "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                                      }
-                                    },
-                                    "conflictResolutionPolicy": {
-                                      "type": "object",
-                                      "defaultValue": {},
-                                      "metadata": {
-                                        "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                                      }
-                                    },
-                                    "defaultTtl": {
-                                      "type": "int",
-                                      "defaultValue": -1,
-                                      "minValue": -1,
-                                      "maxValue": 2147483647,
-                                      "metadata": {
-                                        "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                                      }
-                                    },
-                                    "throughput": {
-                                      "type": "int",
-                                      "defaultValue": 400,
-                                      "metadata": {
-                                        "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                      }
-                                    },
-                                    "autoscaleSettingsMaxThroughput": {
-                                      "type": "int",
-                                      "nullable": true,
-                                      "maxValue": 1000000,
-                                      "metadata": {
-                                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Tags of the SQL Database resource."
-                                      }
-                                    },
-                                    "paths": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 3,
-                                      "metadata": {
-                                        "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                                      }
-                                    },
-                                    "indexingPolicy": {
-                                      "type": "object",
-                                      "defaultValue": {},
-                                      "metadata": {
-                                        "description": "Optional. Indexing policy of the container."
-                                      }
-                                    },
-                                    "uniqueKeyPolicyKeys": {
-                                      "type": "array",
-                                      "defaultValue": [],
-                                      "metadata": {
-                                        "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                                      }
-                                    },
-                                    "kind": {
-                                      "type": "string",
-                                      "defaultValue": "Hash",
-                                      "allowedValues": [
-                                        "Hash",
-                                        "MultiHash"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                                      }
-                                    },
-                                    "version": {
-                                      "type": "int",
-                                      "defaultValue": 1,
-                                      "allowedValues": [
-                                        1,
-                                        2
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "partitionKeyPaths",
-                                        "count": "[length(parameters('paths'))]",
-                                        "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
-                                      }
-                                    ],
-                                    "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
-                                  },
-                                  "resources": {
-                                    "databaseAccount::sqlDatabase": {
-                                      "existing": true,
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
-                                    },
-                                    "databaseAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[parameters('databaseAccountName')]"
-                                    },
-                                    "container": {
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
-                                      "tags": "[parameters('tags')]",
-                                      "properties": {
-                                        "resource": "[variables('containerResourceParams')]",
-                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the container."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the container."
-                                      },
-                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the container was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "sqlDatabase"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the SQL database."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the SQL database."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the SQL database was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_sqlRoleDefinitions": {
-                      "copy": {
-                        "name": "databaseAccount_sqlRoleDefinitions",
-                        "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]"
-                          },
-                          "dataActions": {
-                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
-                          },
-                          "roleName": {
-                            "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]"
-                          },
-                          "assignableScopes": {
-                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
-                          },
-                          "sqlRoleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "9570871897890815068"
-                            },
-                            "name": "DocumentDB Database Account SQL Role Definitions.",
-                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
-                          },
-                          "definitions": {
-                            "sqlRoleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for the SQL Role Assignments."
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The unique identifier of the Role Definition."
-                              }
-                            },
-                            "roleName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
-                              }
-                            },
-                            "dataActions": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. An array of data actions that are allowed."
-                              }
-                            },
-                            "assignableScopes": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
-                              }
-                            },
-                            "sqlRoleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/sqlRoleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "enableReferencedModulesTelemetry": false
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "sqlRoleDefinition": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]",
-                              "properties": {
-                                "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
-                                "permissions": [
-                                  {
-                                    "dataActions": "[parameters('dataActions')]"
-                                  }
-                                ],
-                                "roleName": "[parameters('roleName')]",
-                                "type": "CustomRole"
-                              }
-                            },
-                            "databaseAccount_sqlRoleAssignments": {
-                              "copy": {
-                                "name": "databaseAccount_sqlRoleAssignments",
-                                "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "databaseAccountName": {
-                                    "value": "[parameters('databaseAccountName')]"
-                                  },
-                                  "roleDefinitionId": {
-                                    "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
-                                  },
-                                  "principalId": {
-                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
-                                  },
-                                  "name": {
-                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "10102303164433641479"
-                                    },
-                                    "name": "DocumentDB Database Account SQL Role Assignments.",
-                                    "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
-                                  },
-                                  "parameters": {
-                                    "databaseAccountName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                                      }
-                                    },
-                                    "principalId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                      }
-                                    },
-                                    "roleDefinitionId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The unique identifier of the associated SQL Role Definition."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    }
-                                  },
-                                  "resources": {
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "databaseAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[parameters('databaseAccountName')]"
-                                    },
-                                    "sqlRoleAssignment": {
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
-                                      "properties": {
-                                        "principalId": "[parameters('principalId')]",
-                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the SQL Role Assignment."
-                                      },
-                                      "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the SQL Role Assignment."
-                                      },
-                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the SQL Role Definition was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "sqlRoleDefinition"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the SQL Role Definition."
-                              },
-                              "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the SQL Role Definition."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the SQL Role Definition was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "roleName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The role name of the SQL Role Definition."
-                              },
-                              "value": "[reference('sqlRoleDefinition').roleName]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_sqlRoleAssignments": {
-                      "copy": {
-                        "name": "databaseAccount_sqlRoleAssignments",
-                        "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "roleDefinitionId": {
-                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
-                          },
-                          "principalId": {
-                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]"
-                          },
-                          "name": {
-                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "10102303164433641479"
-                            },
-                            "name": "DocumentDB Database Account SQL Role Assignments.",
-                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                              }
-                            },
-                            "principalId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                              }
-                            },
-                            "roleDefinitionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The unique identifier of the associated SQL Role Definition."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "sqlRoleAssignment": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
-                              "properties": {
-                                "principalId": "[parameters('principalId')]",
-                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the SQL Role Assignment."
-                              },
-                              "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the SQL Role Assignment."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the SQL Role Definition was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_mongodbDatabases": {
-                      "copy": {
-                        "name": "databaseAccount_mongodbDatabases",
-                        "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "collections": {
-                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]"
-                          },
-                          "throughput": {
-                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "9160691107424630312"
-                            },
-                            "name": "DocumentDB Database Account MongoDB Databases",
-                            "description": "This module deploys a MongoDB Database within a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the mongodb database."
-                              }
-                            },
-                            "throughput": {
-                              "type": "int",
-                              "defaultValue": 400,
-                              "metadata": {
-                                "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
-                              }
-                            },
-                            "collections": {
-                              "type": "array",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Collections in the mongodb database."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "mongodbDatabase": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "resource": {
-                                  "id": "[parameters('name')]"
-                                },
-                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
-                              },
-                              "dependsOn": [
-                                "databaseAccount"
-                              ]
-                            },
-                            "mongodbDatabase_collections": {
-                              "copy": {
-                                "name": "mongodbDatabase_collections",
-                                "count": "[length(coalesce(parameters('collections'), createArray()))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "databaseAccountName": {
-                                    "value": "[parameters('databaseAccountName')]"
-                                  },
-                                  "mongodbDatabaseName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "name": {
-                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]"
-                                  },
-                                  "indexes": {
-                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]"
-                                  },
-                                  "shardKey": {
-                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]"
-                                  },
-                                  "throughput": {
-                                    "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "14050805189442830205"
-                                    },
-                                    "name": "DocumentDB Database Account MongoDB Database Collections",
-                                    "description": "This module deploys a MongoDB Database Collection."
-                                  },
-                                  "parameters": {
-                                    "databaseAccountName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "mongodbDatabaseName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Name of the collection."
-                                      }
-                                    },
-                                    "throughput": {
-                                      "type": "int",
-                                      "defaultValue": 400,
-                                      "metadata": {
-                                        "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
-                                      }
-                                    },
-                                    "indexes": {
-                                      "type": "array",
-                                      "metadata": {
-                                        "description": "Required. Indexes for the collection."
-                                      }
-                                    },
-                                    "shardKey": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "description": "Required. ShardKey for the collection."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
-                                      "properties": {
-                                        "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
-                                        "resource": {
-                                          "id": "[parameters('name')]",
-                                          "indexes": "[parameters('indexes')]",
-                                          "shardKey": "[parameters('shardKey')]"
-                                        }
-                                      }
-                                    }
-                                  ],
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the mongodb database collection."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the mongodb database collection."
-                                      },
-                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the mongodb database collection was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "mongodbDatabase"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the mongodb database."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the mongodb database."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the mongodb database was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_gremlinDatabases": {
-                      "copy": {
-                        "name": "databaseAccount_gremlinDatabases",
-                        "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "graphs": {
-                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]"
-                          },
-                          "maxThroughput": {
-                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]"
-                          },
-                          "throughput": {
-                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "16834580070429190924"
-                            },
-                            "name": "DocumentDB Database Account Gremlin Databases",
-                            "description": "This module deploys a Gremlin Database within a CosmosDB Account."
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the Gremlin database."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the Gremlin database resource."
-                              }
-                            },
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "graphs": {
-                              "type": "array",
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. Array of graphs to deploy in the Gremlin database."
-                              }
-                            },
-                            "maxThroughput": {
-                              "type": "int",
-                              "defaultValue": 4000,
-                              "metadata": {
-                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
-                              }
-                            },
-                            "throughput": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "gremlinDatabase": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
-                                "resource": {
-                                  "id": "[parameters('name')]"
-                                }
-                              },
-                              "dependsOn": [
-                                "databaseAccount"
-                              ]
-                            },
-                            "gremlinDatabase_gremlinGraphs": {
-                              "copy": {
-                                "name": "gremlinDatabase_gremlinGraphs",
-                                "count": "[length(parameters('graphs'))]"
-                              },
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('graphs')[copyIndex()].name]"
-                                  },
-                                  "gremlinDatabaseName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "databaseAccountName": {
-                                    "value": "[parameters('databaseAccountName')]"
-                                  },
-                                  "indexingPolicy": {
-                                    "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
-                                  },
-                                  "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "15062578211366932944"
-                                    },
-                                    "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
-                                    "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Name of the graph."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Tags of the Gremlin graph resource."
-                                      }
-                                    },
-                                    "databaseAccountName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "gremlinDatabaseName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "indexingPolicy": {
-                                      "type": "object",
-                                      "defaultValue": {},
-                                      "metadata": {
-                                        "description": "Optional. Indexing policy of the graph."
-                                      }
-                                    },
-                                    "partitionKeyPaths": {
-                                      "type": "array",
-                                      "defaultValue": [],
-                                      "metadata": {
-                                        "description": "Optional. List of paths using which data within the container can be partitioned."
-                                      }
-                                    }
-                                  },
-                                  "resources": {
-                                    "databaseAccount::gremlinDatabase": {
-                                      "existing": true,
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
-                                    },
-                                    "databaseAccount": {
-                                      "existing": true,
-                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[parameters('databaseAccountName')]"
-                                    },
-                                    "gremlinGraph": {
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
-                                      "tags": "[parameters('tags')]",
-                                      "properties": {
-                                        "resource": {
-                                          "id": "[parameters('name')]",
-                                          "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
-                                          "partitionKey": {
-                                            "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
-                                          }
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the graph."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the graph."
-                                      },
-                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the graph was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "gremlinDatabase"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the Gremlin database."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the Gremlin database."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the Gremlin database was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_tables": {
-                      "copy": {
-                        "name": "databaseAccount_tables",
-                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "databaseAccountName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "maxThroughput": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]"
-                          },
-                          "throughput": {
-                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "3429971823201332257"
-                            },
-                            "name": "Azure Cosmos DB account tables",
-                            "description": "This module deploys a table within an Azure Cosmos DB Account."
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the table."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags for the table."
-                              }
-                            },
-                            "databaseAccountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "maxThroughput": {
-                              "type": "int",
-                              "defaultValue": 4000,
-                              "metadata": {
-                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
-                              }
-                            },
-                            "throughput": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "databaseAccount": {
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2024-11-15",
-                              "name": "[parameters('databaseAccountName')]"
-                            },
-                            "table": {
-                              "type": "Microsoft.DocumentDB/databaseAccounts/tables",
-                              "apiVersion": "2024-11-15",
-                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
-                                "resource": {
-                                  "id": "[parameters('name')]"
-                                }
-                              },
-                              "dependsOn": [
-                                "databaseAccount"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the table."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the table."
-                              },
-                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the table was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    },
-                    "databaseAccount_privateEndpoints": {
-                      "copy": {
-                        "name": "databaseAccount_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
-                          },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                          },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                          },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                          },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                          },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                          },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "12389807800450456797"
-                            },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                  }
-                                },
-                                "privateDnsZoneGroupConfigs": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "ipConfigurationType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "memberName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "privateIPAddress": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private endpoint IP configurations."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "privateLinkServiceConnectionType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the private link service connection."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupIds": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                      }
-                                    },
-                                    "privateLinkServiceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource id of private link service."
-                                      }
-                                    },
-                                    "requestMessage": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private link service connection."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "customDnsConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "fqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                  }
-                                },
-                                "ipAddresses": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/ipConfigurationType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              }
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                              }
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Custom DNS configurations."
-                              }
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-05-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                    }
-                                  }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
-                                }
-                              }
-                            },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_roleAssignments": {
-                              "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                  },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.34.44.8038",
-                                      "templateHash": "13997305779829540948"
-                                    },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
-                                          }
-                                        },
-                                        "privateDnsZoneResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "privateEndpointName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "privateDnsZoneConfigs": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 5,
-                                      "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "privateDnsZoneConfigsVar",
-                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                        "input": {
-                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                          "properties": {
-                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                          }
-                                        }
-                                      }
-                                    ]
-                                  },
-                                  "resources": {
-                                    "privateEndpoint": {
-                                      "existing": true,
-                                      "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                      "properties": {
-                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "metadata": {
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                            },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                            },
-                            "groupId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "databaseAccount"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the database account."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the database account."
-                      },
-                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the database account was created in."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('databaseAccount', '2024-11-15', 'full').location]"
-                    },
-                    "endpoint": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The endpoint of the database account."
-                      },
-                      "value": "[reference('databaseAccount').documentEndpoint]"
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the database account."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                        }
-                      }
-                    },
-                    "primaryReadWriteKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary read-write key."
-                      },
-                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]"
-                    },
-                    "primaryReadOnlyKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary read-only key."
-                      },
-                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]"
-                    },
-                    "primaryReadWriteConnectionString": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary read-write connection string."
-                      },
-                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]"
-                    },
-                    "primaryReadOnlyConnectionString": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The primary read-only connection string."
-                      },
-                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]"
-                    },
-                    "secondaryReadWriteKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary read-write key."
-                      },
-                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]"
-                    },
-                    "secondaryReadOnlyKey": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary read-only key."
-                      },
-                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]"
-                    },
-                    "secondaryReadWriteConnectionString": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary read-write connection string."
-                      },
-                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]"
-                    },
-                    "secondaryReadOnlyConnectionString": {
-                      "type": "securestring",
-                      "metadata": {
-                        "description": "The secondary read-only connection string."
-                      },
-                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('cosmosAccount').outputs.resourceId.value]"
-            },
-            "cosmosAccountName": {
-              "type": "string",
-              "value": "[format('{0}.cosmosAccount', deployment().name)]"
-            },
-            "cosmosEndpoint": {
-              "type": "string",
-              "value": "[reference('cosmosAccount').outputs.endpoint.value]"
-            },
-            "cosmosDBName": {
-              "type": "string",
-              "value": "[parameters('cosmosDbName')]"
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "value": "[reference('cosmosAccount').outputs.privateEndpoints.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "userAssignedIdentity"
-      ]
-    },
-    "appConfigStore": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('appConfig-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "appConfigStoreName": {
-            "value": "[variables('appConfigStoreName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "roleAssignedManagedIdentityPrincipalIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.principalId.value]"
-            ]
-          },
-          "enablePrivateEndpoint": {
-            "value": "[variables('isAILZIntegrated')]"
-          },
-          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
-          "appConfigPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.appConfig), createObject('value', ''))]",
-          "publicNetworkAccess": {
-            "value": "Enabled"
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "15550279319246160051"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Location for all resources"
-              }
-            },
-            "appConfigStoreName": {
-              "type": "string",
-              "metadata": {
-                "description": "App Configuration Store name"
-              }
-            },
-            "roleAssignedManagedIdentityPrincipalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "metadata": {
-                "description": "Managed Identity that will be given access to the App Configuration Store"
-              }
-            },
-            "enablePrivateEndpoint": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Enable private endpoint for AILZ mode"
-              }
-            },
-            "privateEndpointSubnetId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "appConfigPrivateDnsZoneId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "App Configuration Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "defaultValue": "Disabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Public network access setting"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "roleAssignments",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignments')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "App Configuration Data Reader"
-                }
-              }
-            ],
-            "deployerRoleAssignments": [
-              {
-                "principalId": "[deployer().objectId]",
-                "principalType": "User",
-                "roleDefinitionIdOrName": "App Configuration Data Owner"
-              }
-            ]
-          },
-          "resources": {
-            "appConfigStore": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}-appConfigStore', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('appConfigStoreName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "sku": {
-                    "value": "Standard"
-                  },
-                  "createMode": {
-                    "value": "Default"
-                  },
-                  "disableLocalAuth": {
-                    "value": false
-                  },
-                  "dataPlaneProxy": {
-                    "value": {
-                      "authenticationMode": "Pass-through",
-                      "privateLinkDelegation": "Disabled"
-                    }
-                  },
-                  "enablePurgeProtection": {
-                    "value": false
-                  },
-                  "softDeleteRetentionInDays": {
-                    "value": 1
-                  },
-                  "roleAssignments": {
-                    "value": "[concat(variables('roleAssignments'), variables('deployerRoleAssignments'))]"
-                  },
-                  "publicNetworkAccess": {
-                    "value": "[parameters('publicNetworkAccess')]"
-                  },
-                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-pe', parameters('appConfigStoreName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'privateLinkServiceConnectionName', format('{0}-app-config-plsc', parameters('appConfigStoreName')), 'privateDnsZoneGroup', if(not(empty(parameters('appConfigPrivateDnsZoneId'))), createObject('name', 'app-config-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'app-config', 'privateDnsZoneResourceId', parameters('appConfigPrivateDnsZoneId')))), null())))), createObject('value', createArray()))]"
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.37.4.10188",
-                      "templateHash": "396653159019145335"
-                    },
-                    "name": "App Configuration Stores",
-                    "description": "This module deploys an App Configuration Store."
-                  },
-                  "definitions": {
-                    "dataPlaneProxyType": {
-                      "type": "object",
-                      "properties": {
-                        "authenticationMode": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Local",
-                            "Pass-through"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The data plane proxy authentication mode. This property manages the authentication mode of request to the data plane resources. 'Pass-through' is recommended."
-                          }
-                        },
-                        "privateLinkDelegation": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Disabled",
-                            "Enabled"
-                          ],
-                          "metadata": {
-                            "description": "Required. The data plane proxy private link delegation. This property manages if a request from delegated Azure Resource Manager (ARM) private link is allowed when the data plane resource requires private link."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the data plane proxy."
-                      }
-                    },
-                    "privateEndpointOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group Id for the private endpoint Group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "FQDN that resolves to private endpoint IP address."
-                                }
-                              },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses of the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "replicaLocationType": {
-                      "type": "object",
-                      "properties": {
-                        "replicaLocation": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Location of the replica."
-                          }
-                        },
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the replica."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a replica location"
-                      }
-                    },
-                    "_1.lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                }
-                              },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "customerManagedKeyWithAutoRotateType": {
-                      "type": "object",
-                      "properties": {
-                        "keyVaultResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                          }
-                        },
-                        "keyName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the customer managed key to use for encryption."
-                          }
-                        },
-                        "keyVersion": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
-                          }
-                        },
-                        "autoRotationEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
-                          }
-                        },
-                        "userAssignedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateEndpointSingleServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private Endpoint."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location to deploy the Private Endpoint to."
-                          }
-                        },
-                        "privateLinkServiceConnectionName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private link connection to create."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                          }
-                        },
-                        "subnetResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                          }
-                        },
-                        "resourceGroupResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                          }
-                        },
-                        "privateDnsZoneGroup": {
-                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                          }
-                        },
-                        "isManualConnection": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. If Manual Private Link Connection is required."
-                          }
-                        },
-                        "manualConnectionRequestMessage": {
-                          "type": "string",
-                          "nullable": true,
-                          "maxLength": 140,
-                          "metadata": {
-                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom DNS configurations."
-                          }
-                        },
-                        "ipConfigurations": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                          }
-                        },
-                        "applicationSecurityGroupResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                          }
-                        },
-                        "customNetworkInterfaceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                          }
-                        },
-                        "lock": {
-                          "$ref": "#/definitions/_1.lockType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                            },
-                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                          }
-                        },
-                        "enableTelemetry": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable/Disable usage telemetry for module."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Azure App Configuration."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "sku": {
-                      "type": "string",
-                      "defaultValue": "Standard",
-                      "allowedValues": [
-                        "Free",
-                        "Developer",
-                        "Standard",
-                        "Premium"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Pricing tier of App Configuration."
-                      }
-                    },
-                    "createMode": {
-                      "type": "string",
-                      "defaultValue": "Default",
-                      "allowedValues": [
-                        "Default",
-                        "Recover"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Indicates whether the configuration store need to be recovered."
-                      }
-                    },
-                    "disableLocalAuth": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Disables all authentication methods other than AAD authentication."
-                      }
-                    },
-                    "enablePurgeProtection": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Property specifying whether protection against purge is enabled for this configuration store. Defaults to true unless sku is set to Free, since purge protection is not available in Free tier."
-                      }
-                    },
-                    "publicNetworkAccess": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set."
-                      }
-                    },
-                    "softDeleteRetentionInDays": {
-                      "type": "int",
-                      "defaultValue": 1,
-                      "minValue": 1,
-                      "maxValue": 7,
-                      "metadata": {
-                        "description": "Optional. The amount of time in days that the configuration store will be retained when it is soft deleted."
-                      }
-                    },
-                    "customerManagedKey": {
-                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The customer managed key definition."
-                      }
-                    },
-                    "keyValues": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. All Key / Values to create. Requires local authentication to be enabled."
-                      }
-                    },
-                    "replicaLocations": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/replicaLocationType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. All Replicas to create."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.AppConfiguration/configurationStores@2024-05-01#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "dataPlaneProxy": {
-                      "$ref": "#/definitions/dataPlaneProxyType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Property specifying the configuration of data plane proxy for Azure Resource Manager (ARM)."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "enableReferencedModulesTelemetry": false,
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "App Compliance Automation Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f37683f-2463-46b6-9ce7-9b788b988ba2')]",
-                      "App Compliance Automation Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ffc6bbe0-e443-4c3b-bf54-26581bb2f78e')]",
-                      "App Configuration Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5ae67dd6-50cb-40e7-96ff-dc2bfa4b606b')]",
-                      "App Configuration Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '516239f1-63e1-4d78-a4de-a74fb236a071')]",
-                      "App Configuration Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '175b81b9-6e0d-490a-85e4-0d422273c10c')]",
-                      "App Configuration Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fe86443c-f201-4fc4-9d2a-ac61149fbda0')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "cMKKeyVault::cMKKey": {
-                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults/keys",
-                      "apiVersion": "2024-11-01",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
-                    },
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[format('46d3xbcp.res.appconfiguration-configurationstore.{0}.{1}', replace('0.9.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "cMKKeyVault": {
-                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2024-12-01-preview",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
-                    },
-                    "cMKUserAssignedIdentity": {
-                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-                      "apiVersion": "2024-11-30",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-                    },
-                    "configurationStore": {
-                      "type": "Microsoft.AppConfiguration/configurationStores",
-                      "apiVersion": "2025-02-01-preview",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "sku": {
-                        "name": "[parameters('sku')]"
-                      },
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "createMode": "[parameters('createMode')]",
-                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
-                        "enablePurgeProtection": "[if(or(equals(parameters('sku'), 'Free'), equals(parameters('sku'), 'Developer')), false(), parameters('enablePurgeProtection'))]",
-                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keyVaultProperties', createObject('keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, parameters('customerManagedKey').keyVersion), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)), 'identityClientId', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), reference('cMKUserAssignedIdentity').clientId, null()))), null())]",
-                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(not(empty(parameters('privateEndpoints'))), 'Disabled', 'Enabled'))]",
-                        "softDeleteRetentionInDays": "[if(or(equals(parameters('sku'), 'Free'), equals(parameters('sku'), 'Developer')), 0, parameters('softDeleteRetentionInDays'))]",
-                        "dataPlaneProxy": "[if(not(empty(parameters('dataPlaneProxy'))), createObject('authenticationMode', coalesce(tryGet(parameters('dataPlaneProxy'), 'authenticationMode'), 'Pass-through'), 'privateLinkDelegation', parameters('dataPlaneProxy').privateLinkDelegation), null())]"
-                      },
-                      "dependsOn": [
-                        "cMKKeyVault::cMKKey",
-                        "cMKUserAssignedIdentity"
-                      ]
-                    },
-                    "configurationStore_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.AppConfiguration/configurationStores/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "configurationStore"
-                      ]
-                    },
-                    "configurationStore_diagnosticSettings": {
-                      "copy": {
-                        "name": "configurationStore_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.AppConfiguration/configurationStores/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "configurationStore"
-                      ]
-                    },
-                    "configurationStore_roleAssignments": {
-                      "copy": {
-                        "name": "configurationStore_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.AppConfiguration/configurationStores/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "configurationStore"
-                      ]
-                    },
-                    "configurationStore_keyValues": {
-                      "copy": {
-                        "name": "configurationStore_keyValues",
-                        "count": "[length(coalesce(parameters('keyValues'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-AppConfig-KeyValues-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "appConfigurationName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "name": {
-                            "value": "[coalesce(parameters('keyValues'), createArray())[copyIndex()].name]"
-                          },
-                          "value": {
-                            "value": "[coalesce(parameters('keyValues'), createArray())[copyIndex()].value]"
-                          },
-                          "contentType": {
-                            "value": "[tryGet(coalesce(parameters('keyValues'), createArray())[copyIndex()], 'contentType')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('keyValues'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "4166303424618131775"
-                            },
-                            "name": "App Configuration Stores Key Values",
-                            "description": "This module deploys an App Configuration Store Key Value."
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the key."
-                              }
-                            },
-                            "value": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The value of the key-value."
-                              }
-                            },
-                            "appConfigurationName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent app configuration store. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "contentType": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The content type of the key-values value. Providing a proper content-type can enable transformations of values when they are retrieved by applications."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "appConfiguration": {
-                              "existing": true,
-                              "type": "Microsoft.AppConfiguration/configurationStores",
-                              "apiVersion": "2025-02-01-preview",
-                              "name": "[parameters('appConfigurationName')]"
-                            },
-                            "keyValues": {
-                              "type": "Microsoft.AppConfiguration/configurationStores/keyValues",
-                              "apiVersion": "2025-02-01-preview",
-                              "name": "[format('{0}/{1}', parameters('appConfigurationName'), parameters('name'))]",
-                              "properties": {
-                                "contentType": "[parameters('contentType')]",
-                                "tags": "[parameters('tags')]",
-                                "value": "[parameters('value')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the key values."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the key values."
-                              },
-                              "value": "[resourceId('Microsoft.AppConfiguration/configurationStores/keyValues', parameters('appConfigurationName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the batch account was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "configurationStore"
-                      ]
-                    },
-                    "configurationStore_replicas": {
-                      "copy": {
-                        "name": "configurationStore_replicas",
-                        "count": "[length(coalesce(parameters('replicaLocations'), createArray()))]",
-                        "mode": "serial",
-                        "batchSize": 1
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-AppConfig-Replicas-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "appConfigurationName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "replicaLocation": {
-                            "value": "[coalesce(parameters('replicaLocations'), createArray())[copyIndex()].replicaLocation]"
-                          },
-                          "name": {
-                            "value": "[tryGet(coalesce(parameters('replicaLocations'), createArray())[copyIndex()], 'name')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "12609356088985615301"
-                            },
-                            "name": "App Configuration Replicas",
-                            "description": "This module deploys an App Configuration Replica."
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "[format('{0}replica', parameters('replicaLocation'))]",
-                              "metadata": {
-                                "description": "Optional. Name of the replica."
-                              }
-                            },
-                            "appConfigurationName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent app configuration store. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "replicaLocation": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Location of the replica."
-                              }
-                            }
-                          },
-                          "resources": [
-                            {
-                              "type": "Microsoft.AppConfiguration/configurationStores/replicas",
-                              "apiVersion": "2025-02-01-preview",
-                              "name": "[format('{0}/{1}', parameters('appConfigurationName'), parameters('name'))]",
-                              "location": "[parameters('replicaLocation')]"
-                            }
-                          ],
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the app configuration was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the replica that was deployed."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the replica that was deployed."
-                              },
-                              "value": "[resourceId('Microsoft.AppConfiguration/configurationStores/replicas', parameters('appConfigurationName'), parameters('name'))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "configurationStore"
-                      ]
-                    },
-                    "configurationStore_privateEndpoints": {
-                      "copy": {
-                        "name": "configurationStore_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "mode": "serial",
-                        "batchSize": 1
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-configStore-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores'), copyIndex()))]"
-                          },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores')))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'configurationStores')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                          },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                          },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                          },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                          },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                          },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "12389807800450456797"
-                            },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                  }
-                                },
-                                "privateDnsZoneGroupConfigs": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "ipConfigurationType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "memberName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "privateIPAddress": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private endpoint IP configurations."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "privateLinkServiceConnectionType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the private link service connection."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupIds": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                      }
-                                    },
-                                    "privateLinkServiceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource id of private link service."
-                                      }
-                                    },
-                                    "requestMessage": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private link service connection."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "customDnsConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "fqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                  }
-                                },
-                                "ipAddresses": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/ipConfigurationType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              }
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                              }
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Custom DNS configurations."
-                              }
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-05-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                    }
-                                  }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
-                                }
-                              }
-                            },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_roleAssignments": {
-                              "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                  },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.34.44.8038",
-                                      "templateHash": "13997305779829540948"
-                                    },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
-                                          }
-                                        },
-                                        "privateDnsZoneResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "privateEndpointName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "privateDnsZoneConfigs": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 5,
-                                      "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "privateDnsZoneConfigsVar",
-                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                        "input": {
-                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                          "properties": {
-                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                          }
-                                        }
-                                      }
-                                    ]
-                                  },
-                                  "resources": {
-                                    "privateEndpoint": {
-                                      "existing": true,
-                                      "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                      "properties": {
-                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "metadata": {
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                            },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                            },
-                            "groupId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "configurationStore"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the app configuration."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the app configuration."
-                      },
-                      "value": "[resourceId('Microsoft.AppConfiguration/configurationStores', parameters('name'))]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource group the app configuration store was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('configurationStore', '2025-02-01-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('configurationStore', '2025-02-01-preview', 'full').location]"
-                    },
-                    "endpoint": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The endpoint of the app configuration."
-                      },
-                      "value": "[reference('configurationStore').endpoint]"
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the app configuration."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('configurationStore_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "endpoint": {
-              "type": "string",
-              "value": "[reference('appConfigStore').outputs.endpoint.value]"
-            },
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('appConfigStore').outputs.resourceId.value]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[reference('appConfigStore').outputs.name.value]"
-            },
-            "privateEndpointIds": {
-              "type": "array",
-              "value": "[reference('appConfigStore').outputs.privateEndpoints.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "userAssignedIdentity"
-      ]
-    },
-    "appConfigStoreKeys": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('appConfigKeys-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "appConfigStoreName": {
-            "value": "[variables('appConfigStoreName')]"
-          },
-          "configurationKeyValues": {
-            "value": [
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.common.COSMOS_DB_ENDPOINT",
-                "value": "[reference('cosmos').outputs.cosmosEndpoint.value]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.common.COSMOS_DB_NAME",
-                "value": "[parameters('cosmosDbName')]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.common.BLOB_STORAGE_ACCOUNT_NAME",
-                "value": "[variables('storageAccountName')]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.common.BLOB_STORAGE_CONTAINER_NAME",
-                "value": "[parameters('docsContainerName')]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.common.STORAGE_ACCOUNT_WORKER_QUEUE_URL",
-                "value": "[reference('storage').outputs.primaryQueueEndpoint.value]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.common.STORAGE_WORKER_QUEUE_NAME",
-                "value": "[parameters('workerQueueName')]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.API_ENABLED",
-                "value": "True"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.DEBUG",
-                "value": "False"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.LOG_LEVEL",
-                "value": "DEBUG"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.API_SERVER_HOST",
-                "value": "0.0.0.0"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.API_SERVER_PORT",
-                "value": "[format('{0}', parameters('apiContainerAppTargetPort'))]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.API_SERVER_WORKERS",
-                "value": "1"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.CORS_ALLOW_CREDENTIALS",
-                "value": "true"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.api.CORS_ALLOW_ORIGINS",
-                "value": "*"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.NUM_PROCESSING_WORKERS",
-                "value": "4"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.NUM_SOURCE_WORKERS",
-                "value": "2"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.LOG_LEVEL",
-                "value": "INFO"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.DEBUG",
-                "value": "false"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.API_ENABLED",
-                "value": "[format('{0}', parameters('workerAPIEnabled'))]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.API_HOST",
-                "value": "0.0.0.0"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.API_PORT",
-                "value": "[format('{0}', parameters('workerContainerAppTargetPort'))]"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.QUEUE_POLL_INTERVAL_SECONDS",
-                "value": "5"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.QUEUE_VISIBILITY_TIMEOUT_SECONDS",
-                "value": "300"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.QUEUE_MAX_MESSAGES",
-                "value": "32"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.MAX_TASK_RETRIES",
-                "value": "3"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.TASK_TIMEOUT_SECONDS",
-                "value": "600"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.DEFAULT_POLLING_INTERVAL_SECONDS",
-                "value": "60"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.SCHEDULER_SLEEP_INTERVAL_SECONDS",
-                "value": "5"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "contentflow.worker.LOCK_TTL_SECONDS",
-                "value": "300"
-              },
-              {
-                "contentType": "text/plain",
-                "name": "sentinel",
-                "value": "1"
-              }
-            ]
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "1913114762964844419"
-            }
-          },
-          "parameters": {
-            "appConfigStoreName": {
-              "type": "string"
-            },
-            "configurationKeyValues": {
-              "type": "array"
-            }
-          },
-          "resources": [
-            {
-              "copy": {
-                "name": "keyValues",
-                "count": "[length(parameters('configurationKeyValues'))]"
-              },
-              "type": "Microsoft.AppConfiguration/configurationStores/keyValues",
-              "apiVersion": "2024-06-01",
-              "name": "[format('{0}/{1}', parameters('appConfigStoreName'), parameters('configurationKeyValues')[copyIndex()].name)]",
-              "properties": {
-                "value": "[parameters('configurationKeyValues')[copyIndex()].value]",
-                "contentType": "[parameters('configurationKeyValues')[copyIndex()].contentType]"
-              }
-            }
-          ]
-        }
-      },
-      "dependsOn": [
-        "appConfigStore",
-        "cosmos",
-        "storage"
-      ]
-    },
-    "containerRegistry": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('acr-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "containerRegistryName": {
-            "value": "[variables('containerRegistryName')]"
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "roleAssignedManagedIdentityPrincipalIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.principalId.value]"
-            ]
-          },
-          "enablePrivateEndpoint": {
-            "value": "[variables('isAILZIntegrated')]"
-          },
-          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateEndpointSubnetId), createObject('value', ''))]",
-          "acrPrivateDnsZoneId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').privateDnsZoneIds.acr), createObject('value', ''))]",
-          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "11955792242736172531"
-            }
-          },
-          "parameters": {
-            "containerRegistryName": {
-              "type": "string",
-              "metadata": {
-                "description": "Required: Name of the Container Registry"
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional: Location for all resources. Default is the resource group location"
-              }
-            },
-            "sku": {
-              "type": "string",
-              "defaultValue": "Standard",
-              "allowedValues": [
-                "Basic",
-                "Premium",
-                "Standard"
-              ],
-              "metadata": {
-                "description": "Optional: Container Registry SKU. Default is Standard, Premium required for private endpoints"
-              }
-            },
-            "adminUserEnabled": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Optional: Admin user enabled. Default is false"
-              }
-            },
-            "enablePrivateEndpoint": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Enable private endpoint for AILZ integrated mode"
-              }
-            },
-            "privateEndpointSubnetId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "acrPrivateDnsZoneId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Azure Container Registry Private DNS Zone ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Public network access setting for the Azure Container Registry"
-              }
-            },
-            "zoneRedundancy": {
-              "type": "string",
-              "defaultValue": "Disabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Zone redundancy setting for the Azure Container Registry"
-              }
-            },
-            "roleAssignedManagedIdentityPrincipalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "metadata": {
-                "description": "Managed Identity that will be given access to the Container Registry"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Optional: Tags for resources"
-              }
-            }
-          },
-          "variables": {
-            "copy": [
-              {
-                "name": "roleAssignmentsAcrPull",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPull')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "AcrPull"
-                }
-              },
-              {
-                "name": "roleAssignmentsAcrPush",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrPush')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "AcrPush"
-                }
-              },
-              {
-                "name": "roleAssignmentsAcrDelete",
-                "count": "[length(parameters('roleAssignedManagedIdentityPrincipalIds'))]",
-                "input": {
-                  "principalId": "[parameters('roleAssignedManagedIdentityPrincipalIds')[copyIndex('roleAssignmentsAcrDelete')]]",
-                  "principalType": "ServicePrincipal",
-                  "roleDefinitionIdOrName": "AcrDelete"
-                }
-              }
-            ]
-          },
-          "resources": {
-            "containerRegistry": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('containerRegistry-{0}', uniqueString('containerRegistry', deployment().name))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('containerRegistryName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "acrSku": "[if(parameters('enablePrivateEndpoint'), createObject('value', 'Premium'), createObject('value', parameters('sku')))]",
-                  "acrAdminUserEnabled": {
-                    "value": "[parameters('adminUserEnabled')]"
-                  },
-                  "publicNetworkAccess": {
-                    "value": "[parameters('publicNetworkAccess')]"
-                  },
-                  "zoneRedundancy": {
-                    "value": "[parameters('zoneRedundancy')]"
-                  },
-                  "roleAssignments": {
-                    "value": "[concat(variables('roleAssignmentsAcrPull'), variables('roleAssignmentsAcrPush'), variables('roleAssignmentsAcrDelete'))]"
-                  },
-                  "privateEndpoints": "[if(parameters('enablePrivateEndpoint'), createObject('value', createArray(createObject('name', format('{0}-pe', parameters('containerRegistryName')), 'resourceGroupResourceId', resourceGroup().id, 'subnetResourceId', parameters('privateEndpointSubnetId'), 'service', 'registry', 'privateLinkServiceConnectionName', format('{0}-acr-plsc', parameters('containerRegistryName')), 'privateDnsZoneGroup', if(not(empty(parameters('acrPrivateDnsZoneId'))), createObject('name', 'acr-dns-zone-group', 'privateDnsZoneGroupConfigs', createArray(createObject('name', 'acr-config', 'privateDnsZoneResourceId', parameters('acrPrivateDnsZoneId')))), null())))), createObject('value', createArray()))]"
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.37.4.10188",
-                      "templateHash": "10440624024470892086"
-                    },
-                    "name": "Azure Container Registries (ACR)",
-                    "description": "This module deploys an Azure Container Registry (ACR)."
-                  },
-                  "definitions": {
-                    "privateEndpointOutputType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The name of the private endpoint."
-                          }
-                        },
-                        "resourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "The resource ID of the private endpoint."
-                          }
-                        },
-                        "groupId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "The group Id for the private endpoint Group."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "fqdn": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "FQDN that resolves to private endpoint IP address."
-                                }
-                              },
-                              "ipAddresses": {
-                                "type": "array",
-                                "items": {
-                                  "type": "string"
-                                },
-                                "metadata": {
-                                  "description": "A list of private IP addresses of the private endpoint."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "The custom DNS configurations of the private endpoint."
-                          }
-                        },
-                        "networkInterfaceResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true
-                      }
-                    },
-                    "scopeMapsType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the scope map."
-                          }
-                        },
-                        "actions": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. The list of scoped permissions for registry artifacts."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The user friendly description of the scope map."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a scope map."
-                      }
-                    },
-                    "cacheRuleType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
-                          }
-                        },
-                        "sourceRepository": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Source repository pulled from upstream."
-                          }
-                        },
-                        "targetRepository": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
-                          }
-                        },
-                        "credentialSetResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a cache rule."
-                      }
-                    },
-                    "credentialSetType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the credential set."
-                          }
-                        },
-                        "managedIdentities": {
-                          "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The managed identity definition for this resource."
-                          }
-                        },
-                        "authCredentials": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/authCredentialsType"
-                          },
-                          "metadata": {
-                            "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
-                          }
-                        },
-                        "loginServer": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The credentials are stored for this upstream or login server."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a credential set."
-                      }
-                    },
-                    "replicationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the replication."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Location for all resources."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Tags of the resource."
-                          }
-                        },
-                        "regionEndpointEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
-                          }
-                        },
-                        "zoneRedundancy": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Disabled",
-                            "Enabled"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a replication."
-                      }
-                    },
-                    "webhookType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "minLength": 5,
-                          "maxLength": 50,
-                          "metadata": {
-                            "description": "Optional. The name of the registry webhook."
-                          }
-                        },
-                        "serviceUri": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The service URI for the webhook to post notifications."
-                          }
-                        },
-                        "status": {
-                          "type": "string",
-                          "allowedValues": [
-                            "disabled",
-                            "enabled"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The status of the webhook at the time the operation was called."
-                          }
-                        },
-                        "action": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The list of actions that trigger the webhook to post notifications."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Location for all resources."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Tags of the resource."
-                          }
-                        },
-                        "customHeaders": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom headers that will be added to the webhook notifications."
-                          }
-                        },
-                        "scope": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a webhook."
-                      }
-                    },
-                    "_1.lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointCustomDnsConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "fqdn": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                          }
-                        },
-                        "ipAddresses": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "metadata": {
-                            "description": "Required. A list of private IP addresses of the private endpoint."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointIpConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the resource that is unique within a resource group."
-                          }
-                        },
-                        "properties": {
-                          "type": "object",
-                          "properties": {
-                            "groupId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "memberName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                              }
-                            },
-                            "privateIPAddress": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of private endpoint IP configurations."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private DNS Zone Group."
-                          }
-                        },
-                        "privateDnsZoneGroupConfigs": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "name": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                }
-                              },
-                              "privateDnsZoneResourceId": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. The resource id of the private DNS zone."
-                                }
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "_1.roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "authCredentialsType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the credential."
-                          }
-                        },
-                        "usernameSecretIdentifier": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. KeyVault Secret URI for accessing the username."
-                          }
-                        },
-                        "passwordSecretIdentifier": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. KeyVault Secret URI for accessing the password."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for auth credentials.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "credential-set/main.bicep"
-                        }
-                      }
-                    },
-                    "customerManagedKeyWithAutoRotateType": {
-                      "type": "object",
-                      "properties": {
-                        "keyVaultResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                          }
-                        },
-                        "keyName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the customer managed key to use for encryption."
-                          }
-                        },
-                        "keyVersion": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
-                          }
-                        },
-                        "autoRotationEnabled": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
-                          }
-                        },
-                        "userAssignedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "diagnosticSettingFullType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the diagnostic setting."
-                          }
-                        },
-                        "logCategoriesAndGroups": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                }
-                              },
-                              "categoryGroup": {
-                                "type": "string",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "managedIdentityOnlySysAssignedType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "privateEndpointSingleServiceType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the Private Endpoint."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location to deploy the Private Endpoint to."
-                          }
-                        },
-                        "privateLinkServiceConnectionName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the private link connection to create."
-                          }
-                        },
-                        "service": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                          }
-                        },
-                        "subnetResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                          }
-                        },
-                        "resourceGroupResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                          }
-                        },
-                        "privateDnsZoneGroup": {
-                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                          }
-                        },
-                        "isManualConnection": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. If Manual Private Link Connection is required."
-                          }
-                        },
-                        "manualConnectionRequestMessage": {
-                          "type": "string",
-                          "nullable": true,
-                          "maxLength": 140,
-                          "metadata": {
-                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                          }
-                        },
-                        "customDnsConfigs": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Custom DNS configurations."
-                          }
-                        },
-                        "ipConfigurations": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                          }
-                        },
-                        "applicationSecurityGroupResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                          }
-                        },
-                        "customNetworkInterfaceName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                          }
-                        },
-                        "lock": {
-                          "$ref": "#/definitions/_1.lockType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/_1.roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Array of role assignments to create."
-                          }
-                        },
-                        "tags": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                            },
-                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                          }
-                        },
-                        "enableTelemetry": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enable/Disable usage telemetry for module."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "minLength": 5,
-                      "maxLength": 50,
-                      "metadata": {
-                        "description": "Required. Name of your Azure Container Registry."
-                      }
-                    },
-                    "acrAdminUserEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Enable admin user that have push / pull permission to the registry."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all resources."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "acrSku": {
-                      "type": "string",
-                      "defaultValue": "Premium",
-                      "allowedValues": [
-                        "Basic",
-                        "Premium",
-                        "Standard"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Tier of your Azure container registry."
-                      }
-                    },
-                    "exportPolicyStatus": {
-                      "type": "string",
-                      "defaultValue": "disabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The value that indicates whether the export policy is enabled or not."
-                      }
-                    },
-                    "quarantinePolicyStatus": {
-                      "type": "string",
-                      "defaultValue": "disabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The value that indicates whether the quarantine policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
-                      }
-                    },
-                    "trustPolicyStatus": {
-                      "type": "string",
-                      "defaultValue": "disabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The value that indicates whether the trust policy is enabled or not. Note, requires the 'acrSku' to be 'Premium'."
-                      }
-                    },
-                    "retentionPolicyStatus": {
-                      "type": "string",
-                      "defaultValue": "enabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The value that indicates whether the retention policy is enabled or not."
-                      }
-                    },
-                    "retentionPolicyDays": {
-                      "type": "int",
-                      "defaultValue": 15,
-                      "metadata": {
-                        "description": "Optional. The number of days to retain an untagged manifest after which it gets purged."
-                      }
-                    },
-                    "azureADAuthenticationAsArmPolicyStatus": {
-                      "type": "string",
-                      "defaultValue": "enabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The value that indicates whether the policy for using ARM audience token for a container registry is enabled or not. Default is enabled."
-                      }
-                    },
-                    "softDeletePolicyStatus": {
-                      "type": "string",
-                      "defaultValue": "disabled",
-                      "allowedValues": [
-                        "disabled",
-                        "enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Soft Delete policy status. Default is disabled."
-                      }
-                    },
-                    "softDeletePolicyDays": {
-                      "type": "int",
-                      "defaultValue": 7,
-                      "metadata": {
-                        "description": "Optional. The number of days after which a soft-deleted item is permanently deleted."
-                      }
-                    },
-                    "dataEndpointEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Enable a single data endpoint per region for serving data. Not relevant in case of disabled public access. Note, requires the 'acrSku' to be 'Premium'."
-                      }
-                    },
-                    "publicNetworkAccess": {
-                      "type": "string",
-                      "nullable": true,
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkRuleSetIpRules are not set.  Note, requires the 'acrSku' to be 'Premium'."
-                      }
-                    },
-                    "networkRuleBypassOptions": {
-                      "type": "string",
-                      "defaultValue": "AzureServices",
-                      "allowedValues": [
-                        "AzureServices",
-                        "None"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether to allow trusted Azure services to access a network restricted registry."
-                      }
-                    },
-                    "networkRuleSetDefaultAction": {
-                      "type": "string",
-                      "defaultValue": "Deny",
-                      "allowedValues": [
-                        "Allow",
-                        "Deny"
-                      ],
-                      "metadata": {
-                        "description": "Optional. The default action of allow or deny when no other rules match."
-                      }
-                    },
-                    "networkRuleSetIpRules": {
-                      "type": "array",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The IP ACL rules. Note, requires the 'acrSku' to be 'Premium'."
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible. Note, requires the 'acrSku' to be 'Premium'."
-                      }
-                    },
-                    "zoneRedundancy": {
-                      "type": "string",
-                      "defaultValue": "Enabled",
-                      "allowedValues": [
-                        "Disabled",
-                        "Enabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
-                      }
-                    },
-                    "replications": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/replicationType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. All replications to create."
-                      }
-                    },
-                    "webhooks": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/webhookType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. All webhooks to create."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.ContainerRegistry/registries@2025-04-01#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingFullType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    },
-                    "anonymousPullEnabled": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Enables registry-wide pull from unauthenticated clients. It's in preview and available in the Standard and Premium service tiers."
-                      }
-                    },
-                    "customerManagedKey": {
-                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The customer managed key definition."
-                      }
-                    },
-                    "cacheRules": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/cacheRuleType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of Cache Rules."
-                      }
-                    },
-                    "credentialSets": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/credentialSetType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of Credential Sets."
-                      }
-                    },
-                    "scopeMaps": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/scopeMapsType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Scope maps setting."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "enableReferencedModulesTelemetry": false,
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "AcrDelete": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c2f4ef07-c644-48eb-af81-4b1b4947fb11')]",
-                      "AcrImageSigner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6cef56e8-d556-48e5-a04f-b8e64114680f')]",
-                      "AcrPull": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')]",
-                      "AcrPush": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8311e382-0749-4cb8-b61a-304f252e45ec')]",
-                      "AcrQuarantineReader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cdda3590-29a3-44f6-95f2-9f980659eb04')]",
-                      "AcrQuarantineWriter": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c8d4ff99-41c3-41a8-9f60-21dfdad59608')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "cMKKeyVault::cMKKey": {
-                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults/keys",
-                      "apiVersion": "2024-11-01",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
-                    },
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.containerregistry-registry.{0}.{1}', replace('0.9.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "cMKKeyVault": {
-                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.KeyVault/vaults",
-                      "apiVersion": "2024-11-01",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
-                    },
-                    "cMKUserAssignedIdentity": {
-                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-                      "existing": true,
-                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-                      "apiVersion": "2024-11-30",
-                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-                    },
-                    "registry": {
-                      "type": "Microsoft.ContainerRegistry/registries",
-                      "apiVersion": "2023-06-01-preview",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "identity": "[variables('identity')]",
-                      "tags": "[parameters('tags')]",
-                      "sku": {
-                        "name": "[parameters('acrSku')]"
-                      },
-                      "properties": {
-                        "anonymousPullEnabled": "[parameters('anonymousPullEnabled')]",
-                        "adminUserEnabled": "[parameters('acrAdminUserEnabled')]",
-                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('status', 'enabled', 'keyVaultProperties', createObject('identity', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyIdentifier', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), format('{0}/{1}', reference('cMKKeyVault::cMKKey').keyUri, tryGet(parameters('customerManagedKey'), 'keyVersion')), if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), reference('cMKKeyVault::cMKKey').keyUri, reference('cMKKeyVault::cMKKey').keyUriWithVersion)))), null())]",
-                        "policies": {
-                          "azureADAuthenticationAsArmPolicy": {
-                            "status": "[parameters('azureADAuthenticationAsArmPolicyStatus')]"
-                          },
-                          "exportPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('exportPolicyStatus')), null())]",
-                          "quarantinePolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('status', parameters('quarantinePolicyStatus')), null())]",
-                          "trustPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('type', 'Notary', 'status', parameters('trustPolicyStatus')), null())]",
-                          "retentionPolicy": "[if(equals(parameters('acrSku'), 'Premium'), createObject('days', parameters('retentionPolicyDays'), 'status', parameters('retentionPolicyStatus')), null())]",
-                          "softDeletePolicy": {
-                            "retentionDays": "[parameters('softDeletePolicyDays')]",
-                            "status": "[parameters('softDeletePolicyStatus')]"
-                          }
-                        },
-                        "dataEndpointEnabled": "[parameters('dataEndpointEnabled')]",
-                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkRuleSetIpRules'))), 'Disabled', null()))]",
-                        "networkRuleBypassOptions": "[parameters('networkRuleBypassOptions')]",
-                        "networkRuleSet": "[if(not(empty(parameters('networkRuleSetIpRules'))), createObject('defaultAction', parameters('networkRuleSetDefaultAction'), 'ipRules', parameters('networkRuleSetIpRules')), null())]",
-                        "zoneRedundancy": "[if(equals(parameters('acrSku'), 'Premium'), parameters('zoneRedundancy'), null())]"
-                      },
-                      "dependsOn": [
-                        "cMKKeyVault::cMKKey",
-                        "cMKUserAssignedIdentity"
-                      ]
-                    },
-                    "registry_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_diagnosticSettings": {
-                      "copy": {
-                        "name": "registry_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          },
-                          {
-                            "name": "logs",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                            "input": {
-                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_roleAssignments": {
-                      "copy": {
-                        "name": "registry_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.ContainerRegistry/registries/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_scopeMaps": {
-                      "copy": {
-                        "name": "registry_scopeMaps",
-                        "count": "[length(coalesce(parameters('scopeMaps'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Registry-Scope-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'name')]"
-                          },
-                          "actions": {
-                            "value": "[coalesce(parameters('scopeMaps'), createArray())[copyIndex()].actions]"
-                          },
-                          "description": {
-                            "value": "[tryGet(coalesce(parameters('scopeMaps'), createArray())[copyIndex()], 'description')]"
-                          },
-                          "registryName": {
-                            "value": "[parameters('name')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "6143951528715126111"
-                            },
-                            "name": "Container Registries scopeMaps",
-                            "description": "This module deploys an Azure Container Registry (ACR) scopeMap."
-                          },
-                          "parameters": {
-                            "registryName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "[format('{0}-scopemaps', parameters('registryName'))]",
-                              "metadata": {
-                                "description": "Optional. The name of the scope map."
-                              }
-                            },
-                            "actions": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "Required. The list of scoped permissions for registry artifacts."
-                              }
-                            },
-                            "description": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The user friendly description of the scope map."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "registry": {
-                              "existing": true,
-                              "type": "Microsoft.ContainerRegistry/registries",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[parameters('registryName')]"
-                            },
-                            "scopeMap": {
-                              "type": "Microsoft.ContainerRegistry/registries/scopeMaps",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                              "properties": {
-                                "actions": "[parameters('actions')]",
-                                "description": "[parameters('description')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the scope map."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the scope map was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the scope map."
-                              },
-                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/scopeMaps', parameters('registryName'), parameters('name'))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_replications": {
-                      "copy": {
-                        "name": "registry_replications",
-                        "count": "[length(coalesce(parameters('replications'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Registry-Replication-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].name]"
-                          },
-                          "registryName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(parameters('replications'), createArray())[copyIndex()].location]"
-                          },
-                          "regionEndpointEnabled": {
-                            "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'regionEndpointEnabled')]"
-                          },
-                          "zoneRedundancy": {
-                            "value": "[tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'zoneRedundancy')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('replications'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "9998680016086915512"
-                            },
-                            "name": "Azure Container Registry (ACR) Replications",
-                            "description": "This module deploys an Azure Container Registry (ACR) Replication."
-                          },
-                          "parameters": {
-                            "registryName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the replication."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all resources."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            },
-                            "regionEndpointEnabled": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Specifies whether the replication regional endpoint is enabled. Requests will not be routed to a replication whose regional endpoint is disabled, however its data will continue to be synced with other replications."
-                              }
-                            },
-                            "zoneRedundancy": {
-                              "type": "string",
-                              "defaultValue": "Disabled",
-                              "allowedValues": [
-                                "Disabled",
-                                "Enabled"
-                              ],
-                              "metadata": {
-                                "description": "Optional. Whether or not zone redundancy is enabled for this container registry."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "registry": {
-                              "existing": true,
-                              "type": "Microsoft.ContainerRegistry/registries",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[parameters('registryName')]"
-                            },
-                            "replication": {
-                              "type": "Microsoft.ContainerRegistry/registries/replications",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "regionEndpointEnabled": "[parameters('regionEndpointEnabled')]",
-                                "zoneRedundancy": "[parameters('zoneRedundancy')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the replication."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the replication."
-                              },
-                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/replications', parameters('registryName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the resource group the replication was created in."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('replication', '2023-06-01-preview', 'full').location]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_credentialSets": {
-                      "copy": {
-                        "name": "registry_credentialSets",
-                        "count": "[length(coalesce(parameters('credentialSets'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Registry-CredentialSet-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].name]"
-                          },
-                          "registryName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "managedIdentities": {
-                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].managedIdentities]"
-                          },
-                          "authCredentials": {
-                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].authCredentials]"
-                          },
-                          "loginServer": {
-                            "value": "[coalesce(parameters('credentialSets'), createArray())[copyIndex()].loginServer]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "10146775336818580275"
-                            },
-                            "name": "Container Registries Credential Sets",
-                            "description": "This module deploys an ACR Credential Set."
-                          },
-                          "definitions": {
-                            "authCredentialsType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the credential."
-                                  }
-                                },
-                                "usernameSecretIdentifier": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. KeyVault Secret URI for accessing the username."
-                                  }
-                                },
-                                "passwordSecretIdentifier": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. KeyVault Secret URI for accessing the password."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for auth credentials."
-                              }
-                            },
-                            "managedIdentityOnlySysAssignedType": {
-                              "type": "object",
-                              "properties": {
-                                "systemAssigned": {
-                                  "type": "bool",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Enables system assigned managed identity on the resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a managed identity configuration. To be used if only system-assigned identities are supported by the resource provider.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "registryName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the credential set."
-                              }
-                            },
-                            "managedIdentities": {
-                              "$ref": "#/definitions/managedIdentityOnlySysAssignedType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The managed identity definition for this resource."
-                              }
-                            },
-                            "authCredentials": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/authCredentialsType"
-                              },
-                              "metadata": {
-                                "description": "Required. List of authentication credentials stored for an upstream. Usually consists of a primary and an optional secondary credential."
-                              }
-                            },
-                            "loginServer": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The credentials are stored for this upstream or login server."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), 'SystemAssigned', null())), null())]"
-                          },
-                          "resources": {
-                            "registry": {
-                              "existing": true,
-                              "type": "Microsoft.ContainerRegistry/registries",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[parameters('registryName')]"
-                            },
-                            "credentialSet": {
-                              "type": "Microsoft.ContainerRegistry/registries/credentialSets",
-                              "apiVersion": "2023-11-01-preview",
-                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                              "identity": "[variables('identity')]",
-                              "properties": {
-                                "authCredentials": "[parameters('authCredentials')]",
-                                "loginServer": "[parameters('loginServer')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The Name of the Credential Set."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the Credential Set."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the Credential Set."
-                              },
-                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/credentialSets', parameters('registryName'), parameters('name'))]"
-                            },
-                            "systemAssignedMIPrincipalId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The principal ID of the system assigned identity."
-                              },
-                              "value": "[tryGet(tryGet(reference('credentialSet', '2023-11-01-preview', 'full'), 'identity'), 'principalId')]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_cacheRules": {
-                      "copy": {
-                        "name": "registry_cacheRules",
-                        "count": "[length(coalesce(parameters('cacheRules'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Registry-Cache-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "registryName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "sourceRepository": {
-                            "value": "[coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository]"
-                          },
-                          "name": {
-                            "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'name')]"
-                          },
-                          "targetRepository": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'targetRepository'), coalesce(parameters('cacheRules'), createArray())[copyIndex()].sourceRepository)]"
-                          },
-                          "credentialSetResourceId": {
-                            "value": "[tryGet(coalesce(parameters('cacheRules'), createArray())[copyIndex()], 'credentialSetResourceId')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "16179895563671172347"
-                            },
-                            "name": "Container Registries Cache",
-                            "description": "Cache for Azure Container Registry (Preview) feature allows users to cache container images in a private container registry. Cache for ACR, is a preview feature available in Basic, Standard, and Premium service tiers ([ref](https://learn.microsoft.com/en-us/azure/container-registry/tutorial-registry-cache))."
-                          },
-                          "parameters": {
-                            "registryName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "[replace(replace(replace(parameters('sourceRepository'), '/', '-'), '.', '-'), '*', '')]",
-                              "metadata": {
-                                "description": "Optional. The name of the cache rule. Will be derived from the source repository name if not defined."
-                              }
-                            },
-                            "sourceRepository": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Source repository pulled from upstream."
-                              }
-                            },
-                            "targetRepository": {
-                              "type": "string",
-                              "defaultValue": "[parameters('sourceRepository')]",
-                              "metadata": {
-                                "description": "Optional. Target repository specified in docker pull command. E.g.: docker pull myregistry.azurecr.io/{targetRepository}:{tag}."
-                              }
-                            },
-                            "credentialSetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the credential store which is associated with the cache rule."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "registry": {
-                              "existing": true,
-                              "type": "Microsoft.ContainerRegistry/registries",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[parameters('registryName')]"
-                            },
-                            "cacheRule": {
-                              "type": "Microsoft.ContainerRegistry/registries/cacheRules",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                              "properties": {
-                                "sourceRepository": "[parameters('sourceRepository')]",
-                                "targetRepository": "[parameters('targetRepository')]",
-                                "credentialSetResourceId": "[parameters('credentialSetResourceId')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The Name of the Cache Rule."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the Cache Rule."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the Cache Rule."
-                              },
-                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/cacheRules', parameters('registryName'), parameters('name'))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "registry",
-                        "registry_credentialSets"
-                      ]
-                    },
-                    "registry_webhooks": {
-                      "copy": {
-                        "name": "registry_webhooks",
-                        "count": "[length(coalesce(parameters('webhooks'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Registry-Webhook-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].name]"
-                          },
-                          "registryName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'location'), parameters('location'))]"
-                          },
-                          "action": {
-                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'action')]"
-                          },
-                          "customHeaders": {
-                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'customHeaders')]"
-                          },
-                          "scope": {
-                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'scope')]"
-                          },
-                          "status": {
-                            "value": "[tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'status')]"
-                          },
-                          "serviceUri": {
-                            "value": "[coalesce(parameters('webhooks'), createArray())[copyIndex()].serviceUri]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('webhooks'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "6514847976022081392"
-                            },
-                            "name": "Azure Container Registry (ACR) Webhooks",
-                            "description": "This module deploys an Azure Container Registry (ACR) Webhook."
-                          },
-                          "parameters": {
-                            "registryName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent registry. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "name": {
-                              "type": "string",
-                              "defaultValue": "[format('{0}webhook', parameters('registryName'))]",
-                              "minLength": 5,
-                              "maxLength": 50,
-                              "metadata": {
-                                "description": "Optional. The name of the registry webhook."
-                              }
-                            },
-                            "serviceUri": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The service URI for the webhook to post notifications."
-                              }
-                            },
-                            "status": {
-                              "type": "string",
-                              "defaultValue": "enabled",
-                              "allowedValues": [
-                                "disabled",
-                                "enabled"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The status of the webhook at the time the operation was called."
-                              }
-                            },
-                            "action": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "defaultValue": [
-                                "chart_delete",
-                                "chart_push",
-                                "delete",
-                                "push",
-                                "quarantine"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The list of actions that trigger the webhook to post notifications."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all resources."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            },
-                            "customHeaders": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Custom headers that will be added to the webhook notifications."
-                              }
-                            },
-                            "scope": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The scope of repositories where the event can be triggered. For example, 'foo:*' means events for all tags under repository 'foo'. 'foo:bar' means events for 'foo:bar' only. 'foo' is equivalent to 'foo:latest'. Empty means all events."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "registry": {
-                              "existing": true,
-                              "type": "Microsoft.ContainerRegistry/registries",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[parameters('registryName')]"
-                            },
-                            "webhook": {
-                              "type": "Microsoft.ContainerRegistry/registries/webhooks",
-                              "apiVersion": "2023-06-01-preview",
-                              "name": "[format('{0}/{1}', parameters('registryName'), parameters('name'))]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "actions": "[parameters('action')]",
-                                "customHeaders": "[parameters('customHeaders')]",
-                                "scope": "[parameters('scope')]",
-                                "serviceUri": "[parameters('serviceUri')]",
-                                "status": "[parameters('status')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the webhook."
-                              },
-                              "value": "[resourceId('Microsoft.ContainerRegistry/registries/webhooks', parameters('registryName'), parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the webhook."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the Azure container registry."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "actions": {
-                              "type": "array",
-                              "metadata": {
-                                "description": "The actions of the webhook."
-                              },
-                              "value": "[reference('webhook').actions]"
-                            },
-                            "status": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The status of the webhook."
-                              },
-                              "value": "[reference('webhook').status]"
-                            },
-                            "provistioningState": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The provisioning state of the webhook."
-                              },
-                              "value": "[reference('webhook').provisioningState]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('webhook', '2023-06-01-preview', 'full').location]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "registry"
-                      ]
-                    },
-                    "registry_privateEndpoints": {
-                      "copy": {
-                        "name": "registry_privateEndpoints",
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                      },
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-registry-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex()))]"
-                          },
-                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')))))), createObject('value', null()))]",
-                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.ContainerRegistry/registries', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'registry')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                          "subnetResourceId": {
-                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                          },
-                          "location": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                          },
-                          "lock": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                          },
-                          "privateDnsZoneGroup": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                          },
-                          "customDnsConfigs": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                          },
-                          "ipConfigurations": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                          },
-                          "applicationSecurityGroupResourceIds": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                          },
-                          "customNetworkInterfaceName": {
-                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.34.44.8038",
-                              "templateHash": "12389807800450456797"
-                            },
-                            "name": "Private Endpoints",
-                            "description": "This module deploys a Private Endpoint."
-                          },
-                          "definitions": {
-                            "privateDnsZoneGroupType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                  }
-                                },
-                                "privateDnsZoneGroupConfigs": {
-                                  "type": "array",
-                                  "items": {
-                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "ipConfigurationType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "memberName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                      }
-                                    },
-                                    "privateIPAddress": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private endpoint IP configurations."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "privateLinkServiceConnectionType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The name of the private link service connection."
-                                  }
-                                },
-                                "properties": {
-                                  "type": "object",
-                                  "properties": {
-                                    "groupIds": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "metadata": {
-                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                      }
-                                    },
-                                    "privateLinkServiceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The resource id of private link service."
-                                      }
-                                    },
-                                    "requestMessage": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of private link service connection."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "customDnsConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "fqdn": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                  }
-                                },
-                                "ipAddresses": {
-                                  "type": "array",
-                                  "items": {
-                                    "type": "string"
-                                  },
-                                  "metadata": {
-                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            },
-                            "privateDnsZoneGroupConfigType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the private DNS zone group config."
-                                  }
-                                },
-                                "privateDnsZoneResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource id of the private DNS zone."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the private endpoint resource to create."
-                              }
-                            },
-                            "subnetResourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                              }
-                            },
-                            "applicationSecurityGroupResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                              }
-                            },
-                            "customNetworkInterfaceName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                              }
-                            },
-                            "ipConfigurations": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/ipConfigurationType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                              }
-                            },
-                            "privateDnsZoneGroup": {
-                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Array of role assignments to create."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                              }
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Custom DNS configurations."
-                              }
-                            },
-                            "manualPrivateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "privateLinkServiceConnections": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "formattedRoleAssignments",
-                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                              }
-                            ],
-                            "builtInRoleNames": {
-                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                            }
-                          },
-                          "resources": {
-                            "avmTelemetry": {
-                              "condition": "[parameters('enableTelemetry')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2024-03-01",
-                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                              "properties": {
-                                "mode": "Incremental",
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "resources": [],
-                                  "outputs": {
-                                    "telemetry": {
-                                      "type": "String",
-                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                    }
-                                  }
-                                }
-                              }
-                            },
-                            "privateEndpoint": {
-                              "type": "Microsoft.Network/privateEndpoints",
-                              "apiVersion": "2024-05-01",
-                              "name": "[parameters('name')]",
-                              "location": "[parameters('location')]",
-                              "tags": "[parameters('tags')]",
-                              "properties": {
-                                "copy": [
-                                  {
-                                    "name": "applicationSecurityGroups",
-                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                    "input": {
-                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                    }
-                                  }
-                                ],
-                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                "subnet": {
-                                  "id": "[parameters('subnetResourceId')]"
-                                }
-                              }
-                            },
-                            "privateEndpoint_lock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_roleAssignments": {
-                              "copy": {
-                                "name": "privateEndpoint_roleAssignments",
-                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                              },
-                              "type": "Microsoft.Authorization/roleAssignments",
-                              "apiVersion": "2022-04-01",
-                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                              "properties": {
-                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            },
-                            "privateEndpoint_privateDnsZoneGroup": {
-                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2022-09-01",
-                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                  },
-                                  "privateEndpointName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "privateDnsZoneConfigs": {
-                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.34.44.8038",
-                                      "templateHash": "13997305779829540948"
-                                    },
-                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                  },
-                                  "definitions": {
-                                    "privateDnsZoneGroupConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private DNS zone group config."
-                                          }
-                                        },
-                                        "privateDnsZoneResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource id of the private DNS zone."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "privateEndpointName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                      }
-                                    },
-                                    "privateDnsZoneConfigs": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                      },
-                                      "minLength": 1,
-                                      "maxLength": 5,
-                                      "metadata": {
-                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                      }
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "metadata": {
-                                        "description": "Optional. The name of the private DNS zone group."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "privateDnsZoneConfigsVar",
-                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                        "input": {
-                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                          "properties": {
-                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                          }
-                                        }
-                                      }
-                                    ]
-                                  },
-                                  "resources": {
-                                    "privateEndpoint": {
-                                      "existing": true,
-                                      "type": "Microsoft.Network/privateEndpoints",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[parameters('privateEndpointName')]"
-                                    },
-                                    "privateDnsZoneGroup": {
-                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                      "apiVersion": "2024-05-01",
-                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                      "properties": {
-                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                      }
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                      },
-                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    }
-                                  }
-                                }
-                              },
-                              "dependsOn": [
-                                "privateEndpoint"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the private endpoint was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the private endpoint."
-                              },
-                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the private endpoint."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The location the resource was deployed into."
-                              },
-                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                            },
-                            "customDnsConfigs": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/customDnsConfigType"
-                              },
-                              "metadata": {
-                                "description": "The custom DNS configurations of the private endpoint."
-                              },
-                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                            },
-                            "networkInterfaceResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "metadata": {
-                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                              },
-                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                            },
-                            "groupId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "The group Id for the private endpoint Group."
-                              },
-                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "registry",
-                        "registry_replications"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The Name of the Azure container registry."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "loginServer": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The reference to the Azure container registry."
-                      },
-                      "value": "[reference('registry').loginServer]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Azure container registry."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Azure container registry."
-                      },
-                      "value": "[resourceId('Microsoft.ContainerRegistry/registries', parameters('name'))]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('registry', '2023-06-01-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('registry', '2023-06-01-preview', 'full').location]"
-                    },
-                    "credentialSetsSystemAssignedMIPrincipalIds": {
-                      "type": "array",
-                      "metadata": {
-                        "description": "The Principal IDs of the ACR Credential Sets system-assigned identities."
-                      },
-                      "copy": {
-                        "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
-                        "input": "[tryGet(tryGet(reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-                      }
-                    },
-                    "credentialSetsResourceIds": {
-                      "type": "array",
-                      "metadata": {
-                        "description": "The Resource IDs of the ACR Credential Sets."
-                      },
-                      "copy": {
-                        "count": "[length(range(0, length(coalesce(parameters('credentialSets'), createArray()))))]",
-                        "input": "[reference(format('registry_credentialSets[{0}]', range(0, length(coalesce(parameters('credentialSets'), createArray())))[copyIndex()])).outputs.resourceId.value]"
-                      }
-                    },
-                    "privateEndpoints": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/privateEndpointOutputType"
-                      },
-                      "metadata": {
-                        "description": "The private endpoints of the Azure container registry."
-                      },
-                      "copy": {
-                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                        "input": {
-                          "name": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                          "resourceId": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                          "groupId": "[tryGet(tryGet(reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                          "customDnsConfigs": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                          "networkInterfaceResourceIds": "[reference(format('registry_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                        }
-                      }
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "value": "[reference('containerRegistry').outputs.name.value]"
-            },
-            "loginServer": {
-              "type": "string",
-              "value": "[reference('containerRegistry').outputs.loginServer.value]"
-            },
-            "resourceGroupName": {
-              "type": "string",
-              "value": "[reference('containerRegistry').outputs.resourceGroupName.value]"
-            },
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('containerRegistry').outputs.resourceId.value]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "value": "[tryGet(tryGet(reference('containerRegistry').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-            },
-            "credentialSetsSystemAssignedMIPrincipalIds": {
-              "type": "array",
-              "value": "[reference('containerRegistry').outputs.credentialSetsSystemAssignedMIPrincipalIds.value]"
-            },
-            "credentialSetsResourceIds": {
-              "type": "array",
-              "value": "[reference('containerRegistry').outputs.credentialSetsResourceIds.value]"
-            },
-            "privateEndpoints": {
-              "type": "array",
-              "value": "[reference('containerRegistry').outputs.privateEndpoints.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "userAssignedIdentity"
-      ]
-    },
-    "containerAppsEnvironment": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('cae-la-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "containerAppsEnvironmentName": {
-            "value": "[variables('containerAppsEnvironmentName')]"
-          },
-          "logAnalyticsWorkspaceResourceId": "[if(not(empty(parameters('existingLogAnalyticsWorkspaceId'))), createObject('value', parameters('existingLogAnalyticsWorkspaceId')), if(variables('shouldCreateLogAnalytics'), createObject('value', reference('logAnalytics').outputs.resourceId.value), createObject('value', '')))]",
-          "userAssignedResourceIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.resourceId.value]"
-            ]
-          },
-          "location": {
-            "value": "[parameters('location')]"
-          },
-          "enablePrivateEndpoint": {
-            "value": "[variables('isAILZIntegrated')]"
-          },
-          "privateEndpointSubnetId": "[if(variables('isAILZIntegrated'), createObject('value', variables('networkConfig').containerAppsSubnetId), createObject('value', null()))]",
-          "publicNetworkAccess": "[if(variables('isAILZIntegrated'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "6720674191352473803"
-            }
-          },
-          "parameters": {
-            "containerAppsEnvironmentName": {
-              "type": "string",
-              "metadata": {
-                "description": "Name of the Container Apps Environment"
-              }
-            },
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Location for all resources"
-              }
-            },
-            "logAnalyticsWorkspaceResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Log Analytics workspace resource ID used to derive customer ID and shared key"
-              }
-            },
-            "userAssignedResourceIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "metadata": {
-                "description": "User Assigned Identity resource IDs that will be assigned to the Container Apps Environment"
-              }
-            },
-            "enablePrivateEndpoint": {
-              "type": "bool",
-              "defaultValue": false,
-              "metadata": {
-                "description": "Enable private endpoint for AILZ integrated mode"
-              }
-            },
-            "privateEndpointSubnetId": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Subnet ID for private endpoint (required when enablePrivateEndpoint is true)"
-              }
-            },
-            "publicNetworkAccess": {
-              "type": "string",
-              "defaultValue": "Enabled",
-              "allowedValues": [
-                "Enabled",
-                "Disabled"
-              ],
-              "metadata": {
-                "description": "Public network access setting for the Azure Container Registry"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "resources": {
-            "containerAppsEnvironment": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}.containerAppsEnvironment', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('containerAppsEnvironmentName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "zoneRedundant": {
-                    "value": false
-                  },
-                  "appLogsConfiguration": {
-                    "value": {
-                      "destination": "log-analytics",
-                      "logAnalyticsConfiguration": {
-                        "customerId": "[reference(parameters('logAnalyticsWorkspaceResourceId'), '2021-12-01-preview').customerId]",
-                        "sharedKey": "[listKeys(parameters('logAnalyticsWorkspaceResourceId'), '2021-12-01-preview').primarySharedKey]"
-                      }
-                    }
-                  },
-                  "workloadProfiles": {
-                    "value": [
-                      {
-                        "name": "Consumption",
-                        "workloadProfileType": "Consumption"
-                      }
-                    ]
-                  },
-                  "platformReservedCidr": {
-                    "value": "172.17.17.0/24"
-                  },
-                  "platformReservedDnsIP": {
-                    "value": "172.17.17.17"
-                  },
-                  "publicNetworkAccess": {
-                    "value": "[parameters('publicNetworkAccess')]"
-                  },
-                  "internal": {
-                    "value": "[parameters('enablePrivateEndpoint')]"
-                  },
-                  "infrastructureSubnetResourceId": "[if(parameters('enablePrivateEndpoint'), createObject('value', parameters('privateEndpointSubnetId')), createObject('value', null()))]",
-                  "managedIdentities": {
-                    "value": {
-                      "systemAssigned": true,
-                      "userAssignedResourceIds": "[parameters('userAssignedResourceIds')]"
-                    }
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.37.4.10188",
-                      "templateHash": "1345160196550942789"
-                    },
-                    "name": "App ManagedEnvironments",
-                    "description": "This module deploys an App Managed Environment (also known as a Container App Environment)."
-                  },
-                  "definitions": {
-                    "certificateType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the certificate."
-                          }
-                        },
-                        "certificateType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "ImagePullTrustedCA",
-                            "ServerSSLCertificate"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The type of the certificate."
-                          }
-                        },
-                        "certificateValue": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The value of the certificate. PFX or PEM blob."
-                          }
-                        },
-                        "certificatePassword": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The password of the certificate."
-                          }
-                        },
-                        "certificateKeyVaultProperties": {
-                          "$ref": "#/definitions/certificateKeyVaultPropertiesType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A key vault reference."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a certificate."
-                      }
-                    },
-                    "storageType": {
-                      "type": "object",
-                      "properties": {
-                        "accessMode": {
-                          "type": "string",
-                          "allowedValues": [
-                            "ReadOnly",
-                            "ReadWrite"
-                          ],
-                          "metadata": {
-                            "description": "Required. Access mode for storage: \"ReadOnly\" or \"ReadWrite\"."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "NFS",
-                            "SMB"
-                          ],
-                          "metadata": {
-                            "description": "Required. Type of storage: \"SMB\" or \"NFS\"."
-                          }
-                        },
-                        "storageAccountName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Storage account name."
-                          }
-                        },
-                        "shareName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. File share name."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type of the storage."
-                      }
-                    },
-                    "appLogsConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "destination": {
-                          "type": "string",
-                          "allowedValues": [
-                            "azure-monitor",
-                            "log-analytics",
-                            "none"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The destination of the logs."
-                          }
-                        },
-                        "logAnalyticsConfiguration": {
-                          "type": "object",
-                          "properties": {
-                            "customerId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The Log Analytics Workspace ID."
-                              }
-                            },
-                            "sharedKey": {
-                              "type": "securestring",
-                              "metadata": {
-                                "description": "Required. The shared key of the Log Analytics workspace."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The Log Analytics configuration. Required if `destination` is `log-analytics`."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the App Logs Configuration."
-                      }
-                    },
-                    "certificateKeyVaultPropertiesType": {
-                      "type": "object",
-                      "properties": {
-                        "identityResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
-                          }
-                        },
-                        "keyVaultUrl": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for the certificate's key vault properties.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "certificates/main.bicep"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Container Apps Managed Environment."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/managedEnvironments@2024-10-02-preview#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "appInsightsConnectionString": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Application Insights connection string."
-                      }
-                    },
-                    "daprAIConnectionString": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Application Insights connection string used by Dapr to export Service to Service communication telemetry."
-                      }
-                    },
-                    "daprAIInstrumentationKey": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Azure Monitor instrumentation key used by Dapr to export Service to Service communication telemetry."
-                      }
-                    },
-                    "dockerBridgeCidr": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. CIDR notation IP range assigned to the Docker bridge, network. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "infrastructureSubnetResourceId": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. Resource ID of a subnet for infrastructure components. This is used to deploy the environment into a virtual network. Must not overlap with any other provided IP ranges. Required if \"internal\" is set to true. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "internal": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Conditional. Boolean indicating the environment only has an internal load balancer. These environments do not have a public static IP resource. If set to true, then \"infrastructureSubnetId\" must be provided. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "platformReservedCidr": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. IP range in CIDR notation that can be reserved for environment infrastructure IP addresses. It must not overlap with any other provided IP ranges and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true  to make the resource WAF compliant."
-                      }
-                    },
-                    "platformReservedDnsIP": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Conditional. An IP address from the IP range defined by \"platformReservedCidr\" that will be reserved for the internal DNS server. It must not be the first address in the range and can only be used when the environment is deployed into a virtual network. If not provided, it will be set with a default value by the platform. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "peerTrafficEncryption": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether or not to encrypt peer traffic."
-                      }
-                    },
-                    "publicNetworkAccess": {
-                      "type": "string",
-                      "defaultValue": "Disabled",
-                      "allowedValues": [
-                        "Enabled",
-                        "Disabled"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Whether to allow or block all public traffic."
-                      }
-                    },
-                    "zoneRedundant": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Whether or not this Managed Environment is zone-redundant."
-                      }
-                    },
-                    "certificatePassword": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Password of the certificate used by the custom domain."
-                      }
-                    },
-                    "certificateValue": {
-                      "type": "securestring",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. Certificate to use for the custom domain. PFX or PEM."
-                      }
-                    },
-                    "dnsSuffix": {
-                      "type": "string",
-                      "defaultValue": "",
-                      "metadata": {
-                        "description": "Optional. DNS suffix for the environment domain."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "openTelemetryConfiguration": {
-                      "type": "object",
-                      "defaultValue": {},
-                      "metadata": {
-                        "description": "Optional. Open Telemetry configuration."
-                      }
-                    },
-                    "workloadProfiles": {
-                      "type": "array",
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Conditional. Workload profiles configured for the Managed Environment. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "infrastructureResourceGroupName": {
-                      "type": "string",
-                      "defaultValue": "[take(format('ME_{0}', parameters('name')), 63)]",
-                      "metadata": {
-                        "description": "Conditional. Name of the infrastructure resource group. If not provided, it will be set with a default value. Required if zoneRedundant is set to true to make the resource WAF compliant."
-                      }
-                    },
-                    "storages": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/storageType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The list of storages to mount on the environment."
-                      }
-                    },
-                    "certificate": {
-                      "$ref": "#/definitions/certificateType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. A Managed Environment Certificate."
-                      }
-                    },
-                    "appLogsConfiguration": {
-                      "$ref": "#/definitions/appLogsConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The AppLogsConfiguration for the Managed Environment."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "managedEnvironment::storage": {
-                      "copy": {
-                        "name": "managedEnvironment::storage",
-                        "count": "[length(coalesce(parameters('storages'), createArray()))]"
-                      },
-                      "type": "Microsoft.App/managedEnvironments/storages",
-                      "apiVersion": "2024-10-02-preview",
-                      "name": "[format('{0}/{1}', parameters('name'), coalesce(parameters('storages'), createArray())[copyIndex()].shareName)]",
-                      "properties": {
-                        "nfsAzureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'NFS'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'server', format('{0}.file.{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, environment().suffixes.storage), 'shareName', format('/{0}/{1}', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, coalesce(parameters('storages'), createArray())[copyIndex()].shareName)), null())]",
-                        "azureFile": "[if(equals(coalesce(parameters('storages'), createArray())[copyIndex()].kind, 'SMB'), createObject('accessMode', coalesce(parameters('storages'), createArray())[copyIndex()].accessMode, 'accountName', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName, 'accountKey', listkeys(resourceId('Microsoft.Storage/storageAccounts', coalesce(parameters('storages'), createArray())[copyIndex()].storageAccountName), '2023-01-01').keys[0].value, 'shareName', coalesce(parameters('storages'), createArray())[copyIndex()].shareName), null())]"
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    },
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-11-01",
-                      "name": "[format('46d3xbcp.res.app-managedenvironment.{0}.{1}', replace('0.11.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "managedEnvironment": {
-                      "type": "Microsoft.App/managedEnvironments",
-                      "apiVersion": "2024-10-02-preview",
-                      "name": "[parameters('name')]",
-                      "location": "[parameters('location')]",
-                      "tags": "[parameters('tags')]",
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "appInsightsConfiguration": {
-                          "connectionString": "[parameters('appInsightsConnectionString')]"
-                        },
-                        "appLogsConfiguration": "[parameters('appLogsConfiguration')]",
-                        "daprAIConnectionString": "[parameters('daprAIConnectionString')]",
-                        "daprAIInstrumentationKey": "[parameters('daprAIInstrumentationKey')]",
-                        "customDomainConfiguration": {
-                          "certificatePassword": "[parameters('certificatePassword')]",
-                          "certificateValue": "[if(not(empty(parameters('certificateValue'))), parameters('certificateValue'), null())]",
-                          "dnsSuffix": "[parameters('dnsSuffix')]",
-                          "certificateKeyVaultProperties": "[if(not(empty(tryGet(parameters('certificate'), 'certificateKeyVaultProperties'))), createObject('identity', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'identityResourceId'), 'keyVaultUrl', tryGet(parameters('certificate'), 'certificateKeyVaultProperties', 'keyVaultUrl')), null())]"
-                        },
-                        "openTelemetryConfiguration": "[if(not(empty(parameters('openTelemetryConfiguration'))), parameters('openTelemetryConfiguration'), null())]",
-                        "peerTrafficConfiguration": {
-                          "encryption": {
-                            "enabled": "[parameters('peerTrafficEncryption')]"
-                          }
-                        },
-                        "publicNetworkAccess": "[parameters('publicNetworkAccess')]",
-                        "vnetConfiguration": {
-                          "internal": "[parameters('internal')]",
-                          "infrastructureSubnetId": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('infrastructureSubnetResourceId'), null())]",
-                          "dockerBridgeCidr": "[if(not(empty(parameters('infrastructureSubnetResourceId'))), parameters('dockerBridgeCidr'), null())]",
-                          "platformReservedCidr": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedCidr'), null())]",
-                          "platformReservedDnsIP": "[if(and(empty(parameters('workloadProfiles')), not(empty(parameters('infrastructureSubnetResourceId')))), parameters('platformReservedDnsIP'), null())]"
-                        },
-                        "workloadProfiles": "[if(not(empty(parameters('workloadProfiles'))), parameters('workloadProfiles'), null())]",
-                        "zoneRedundant": "[parameters('zoneRedundant')]",
-                        "infrastructureResourceGroup": "[parameters('infrastructureResourceGroupName')]"
-                      }
-                    },
-                    "managedEnvironment_roleAssignments": {
-                      "copy": {
-                        "name": "managedEnvironment_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/managedEnvironments', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    },
-                    "managedEnvironment_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.App/managedEnvironments/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    },
-                    "managedEnvironment_certificate": {
-                      "condition": "[not(empty(parameters('certificate')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2022-09-01",
-                      "name": "[format('{0}-Managed-Environment-Certificate', uniqueString(deployment().name))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[coalesce(tryGet(parameters('certificate'), 'name'), format('cert-{0}', parameters('name')))]"
-                          },
-                          "managedEnvironmentName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "certificateKeyVaultProperties": {
-                            "value": "[tryGet(parameters('certificate'), 'certificateKeyVaultProperties')]"
-                          },
-                          "certificateType": {
-                            "value": "[tryGet(parameters('certificate'), 'certificateType')]"
-                          },
-                          "certificateValue": {
-                            "value": "[tryGet(parameters('certificate'), 'certificateValue')]"
-                          },
-                          "certificatePassword": {
-                            "value": "[tryGet(parameters('certificate'), 'certificatePassword')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.37.4.10188",
-                              "templateHash": "13507794255589178049"
-                            },
-                            "name": "App ManagedEnvironments Certificates",
-                            "description": "This module deploys a App Managed Environment Certificate."
-                          },
-                          "definitions": {
-                            "certificateKeyVaultPropertiesType": {
-                              "type": "object",
-                              "properties": {
-                                "identityResourceId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource ID of the identity. This is the identity that will be used to access the key vault."
-                                  }
-                                },
-                                "keyVaultUrl": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. A key vault URL referencing the wildcard certificate that will be used for the custom domain."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "The type for the certificate's key vault properties."
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the Container Apps Managed Environment Certificate."
-                              }
-                            },
-                            "managedEnvironmentName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent app managed environment. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Location for all Resources."
-                              }
-                            },
-                            "certificateKeyVaultProperties": {
-                              "$ref": "#/definitions/certificateKeyVaultPropertiesType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. A key vault reference to the certificate to use for the custom domain."
-                              }
-                            },
-                            "certificateType": {
-                              "type": "string",
-                              "nullable": true,
-                              "allowedValues": [
-                                "ServerSSLCertificate",
-                                "ImagePullTrustedCA"
-                              ],
-                              "metadata": {
-                                "description": "Optional. The type of the certificate."
-                              }
-                            },
-                            "certificateValue": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The value of the certificate. PFX or PEM blob."
-                              }
-                            },
-                            "certificatePassword": {
-                              "type": "securestring",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The password of the certificate."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Tags of the resource."
-                              }
-                            }
-                          },
-                          "resources": {
-                            "managedEnvironment": {
-                              "existing": true,
-                              "type": "Microsoft.App/managedEnvironments",
-                              "apiVersion": "2024-10-02-preview",
-                              "name": "[parameters('managedEnvironmentName')]"
-                            },
-                            "managedEnvironmentCertificate": {
-                              "type": "Microsoft.App/managedEnvironments/certificates",
-                              "apiVersion": "2024-10-02-preview",
-                              "name": "[format('{0}/{1}', parameters('managedEnvironmentName'), parameters('name'))]",
-                              "location": "[parameters('location')]",
-                              "properties": {
-                                "certificateKeyVaultProperties": "[if(not(empty(parameters('certificateKeyVaultProperties'))), createObject('identity', parameters('certificateKeyVaultProperties').identityResourceId, 'keyVaultUrl', parameters('certificateKeyVaultProperties').keyVaultUrl), null())]",
-                                "certificateType": "[parameters('certificateType')]",
-                                "password": "[parameters('certificatePassword')]",
-                                "value": "[parameters('certificateValue')]"
-                              },
-                              "tags": "[parameters('tags')]"
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the key values."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the key values."
-                              },
-                              "value": "[resourceId('Microsoft.App/managedEnvironments/certificates', parameters('managedEnvironmentName'), parameters('name'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group the batch account was deployed into."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "managedEnvironment"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the Managed Environment was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('managedEnvironment', '2024-10-02-preview', 'full').location]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Managed Environment."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Managed Environment."
-                      },
-                      "value": "[resourceId('Microsoft.App/managedEnvironments', parameters('name'))]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('managedEnvironment', '2024-10-02-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "defaultDomain": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The Default domain of the Managed Environment."
-                      },
-                      "value": "[reference('managedEnvironment').defaultDomain]"
-                    },
-                    "staticIp": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The IP address of the Managed Environment."
-                      },
-                      "value": "[reference('managedEnvironment').staticIp]"
-                    },
-                    "domainVerificationId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The domain verification id for custom domains."
-                      },
-                      "value": "[reference('managedEnvironment').customDomainConfiguration.customDomainVerificationId]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "name": {
-              "type": "string",
-              "value": "[reference('containerAppsEnvironment').outputs.name.value]"
-            },
-            "resourceId": {
-              "type": "string",
-              "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
-            },
-            "location": {
-              "type": "string",
-              "value": "[reference('containerAppsEnvironment').outputs.location.value]"
-            },
-            "systemAssignedMIPrincipalId": {
-              "type": "string",
-              "nullable": true,
-              "value": "[tryGet(tryGet(reference('containerAppsEnvironment').outputs, 'systemAssignedMIPrincipalId'), 'value')]"
-            },
-            "defaultDomain": {
-              "type": "string",
-              "value": "[reference('containerAppsEnvironment').outputs.defaultDomain.value]"
-            },
-            "staticIp": {
-              "type": "string",
-              "value": "[reference('containerAppsEnvironment').outputs.staticIp.value]"
-            },
-            "domainVerificationId": {
-              "type": "string",
-              "value": "[reference('containerAppsEnvironment').outputs.domainVerificationId.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "logAnalytics",
-        "userAssignedIdentity"
-      ]
-    },
-    "aiFoundry": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('aiFoundry-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "aiFoundryBaseName": {
-            "value": "[substring(format('aif{0}', variables('resourceToken')), 0, 12)]"
-          },
-          "roleAssignedManagedIdentityPrincipalIds": {
-            "value": [
-              "[reference('userAssignedIdentity').outputs.principalId.value]"
-            ]
-          },
-          "location": {
-            "value": "[parameters('foundryLocation')]"
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "6680056687043492516"
-            }
-          },
-          "parameters": {
-            "location": {
-              "type": "string",
-              "defaultValue": "[resourceGroup().location]",
-              "metadata": {
-                "description": "Optional: Location for all resources. Default is the resource group location"
-              }
-            },
-            "aiFoundryBaseName": {
-              "type": "string",
-              "metadata": {
-                "description": "Required: The AI Foundry base name (max 12 characters)"
-              }
-            },
-            "roleAssignedManagedIdentityPrincipalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "defaultValue": [],
-              "metadata": {
-                "description": "Managed Identity that will be given access to the AI Foundry Resource"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "variables": {
-            "uniqueRoleAssignmentManagedIdentities": "[union(parameters('roleAssignedManagedIdentityPrincipalIds'), parameters('roleAssignedManagedIdentityPrincipalIds'))]"
-          },
-          "resources": {
-            "aiFoundry": {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('aiFoundry-{0}', uniqueString('aiFoundry', deployment().name))]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "baseName": {
-                    "value": "[parameters('aiFoundryBaseName')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "aiFoundryConfiguration": {
-                    "value": {
-                      "copy": [
-                        {
-                          "name": "roleAssignments",
-                          "count": "[length(variables('uniqueRoleAssignmentManagedIdentities'))]",
-                          "input": {
-                            "principalId": "[variables('uniqueRoleAssignmentManagedIdentities')[copyIndex('roleAssignments')]]",
-                            "principalType": "ServicePrincipal",
-                            "roleDefinitionIdOrName": "53ca6127-db72-4b80-b1b0-d745d6d5456d"
-                          }
-                        }
-                      ],
-                      "allowProjectManagement": true,
-                      "createCapabilityHosts": false,
-                      "disableLocalAuth": true,
-                      "location": "[parameters('location')]",
-                      "project": {
-                        "desc": "AI Foundry project for ContentFlow Solution Accelerator",
-                        "displayName": "ContentFlow",
-                        "name": "contentflow-project"
-                      },
-                      "sku": "S0"
-                    }
-                  },
-                  "aiModelDeployments": {
-                    "value": [
-                      {
-                        "model": {
-                          "format": "OpenAI",
-                          "name": "gpt-4.1-mini",
-                          "version": "2025-04-14"
-                        },
-                        "name": "gpt-4.1-mini",
-                        "sku": {
-                          "capacity": 100,
-                          "name": "GlobalStandard"
-                        }
-                      },
-                      {
-                        "model": {
-                          "format": "OpenAI",
-                          "name": "gpt-4.1",
-                          "version": "2025-04-14"
-                        },
-                        "name": "gpt-4.1",
-                        "sku": {
-                          "capacity": 100,
-                          "name": "GlobalStandard"
-                        }
-                      },
-                      {
-                        "model": {
-                          "format": "OpenAI",
-                          "name": "text-embedding-3-large",
-                          "version": "1"
-                        },
-                        "name": "text-embedding-3-large",
-                        "sku": {
-                          "capacity": 100,
-                          "name": "Standard"
-                        }
-                      }
-                    ]
-                  },
-                  "includeAssociatedResources": {
-                    "value": false
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.38.33.27573",
-                      "templateHash": "16692041582792913299"
-                    },
-                    "name": "ai-foundry",
-                    "description": "Creates an AI Foundry account and project with Standard Agent Services."
-                  },
-                  "definitions": {
-                    "resourceConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "existingResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of an existing resource to use instead of creating a new one. If provided, other parameters are ignored."
-                          }
-                        },
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name to be used when creating the resource. This is ignored if an existingResourceId is provided."
-                          }
-                        },
-                        "privateDnsZoneResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource ID of the Private DNS Zone that associates with the resource. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Custom configuration for a resource, including optional name, existing resource ID, and role assignments."
-                      }
-                    },
-                    "storageAccountConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "existingResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource Id of an existing Storage Account to use instead of creating a new one. If provided, other parameters are ignored."
-                          }
-                        },
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name to be used when creating the Storage Account. This is ignored if an existingResourceId is provided."
-                          }
-                        },
-                        "blobPrivateDnsZoneResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource ID of the DNS zone \"blob\" for the Azure Storage Account. This is required to establish a Private Endpoint and when 'privateEndpointSubnetResourceId' is provided."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Role assignments to apply to the resource when creating it. This is ignored if an existingResourceId is provided."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Custom configuration for a Storage Account, including optional name, existing resource ID, containers, and role assignments."
-                      }
-                    },
-                    "foundryConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "accountName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the AI Foundry account."
-                          }
-                        },
-                        "location": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The location of the AI Foundry account. Will default to the resource group location if not specified."
-                          }
-                        },
-                        "sku": {
-                          "type": "string",
-                          "allowedValues": [
-                            "C2",
-                            "C3",
-                            "C4",
-                            "DC0",
-                            "F0",
-                            "F1",
-                            "S",
-                            "S0",
-                            "S1",
-                            "S10",
-                            "S2",
-                            "S3",
-                            "S4",
-                            "S5",
-                            "S6",
-                            "S7",
-                            "S8",
-                            "S9"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region. Defaults to 'S0'."
-                          }
-                        },
-                        "createCapabilityHosts": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Whether to create Capability Hosts for the AI Agent Service. If true, the AI Foundry Account and default Project will be created with the capability host for the associated resources. Can only be true if 'includeAssociatedResources' is true. Defaults to false."
-                          }
-                        },
-                        "disableLocalAuth": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons. Defaults to true."
-                          }
-                        },
-                        "allowProjectManagement": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Whether to allow project management in the AI Foundry account. If true, users can create and manage projects within the AI Foundry account. Defaults to true."
-                          }
-                        },
-                        "networking": {
-                          "$ref": "#/definitions/foundryNetworkConfigurationType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Values to establish private networking for the AI Foundry account and project."
-                          }
-                        },
-                        "project": {
-                          "$ref": "#/definitions/foundryProjectConfigurationType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. AI Foundry default project."
-                          }
-                        },
-                        "roleAssignments": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/roleAssignmentType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Role assignments to apply to the AI Foundry resource when creating it."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Custom configuration for a AI Foundry, including optional account name and project configuration."
-                      }
-                    },
-                    "foundryNetworkConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "agentServiceSubnetResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource ID of the subnet for the Azure AI Services account. This is required if 'createAIAgentService' is true."
-                          }
-                        },
-                        "cognitiveServicesPrivateDnsZoneResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account."
-                          }
-                        },
-                        "openAiPrivateDnsZoneResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The Resource ID of the Private DNS Zone for the OpenAI account."
-                          }
-                        },
-                        "aiServicesPrivateDnsZoneResourceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The Resource ID of the Private DNS Zone for the Azure AI Services account."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Values to establish private networking for the AI Foundry service."
-                      }
-                    },
-                    "foundryProjectConfigurationType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the AI Foundry project."
-                          }
-                        },
-                        "displayName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The friendly/display name of the AI Foundry project."
-                          }
-                        },
-                        "desc": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the AI Foundry project."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "Custom configuration for an AI Foundry project, including optional name, friendly name, and description."
-                      }
-                    },
-                    "deploymentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of cognitive service account deployment."
-                          }
-                        },
-                        "model": {
-                          "type": "object",
-                          "properties": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of Cognitive Services account deployment model."
-                              }
-                            },
-                            "format": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The format of Cognitive Services account deployment model."
-                              }
-                            },
-                            "version": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The version of Cognitive Services account deployment model."
-                              }
-                            }
-                          },
-                          "metadata": {
-                            "description": "Required. Properties of Cognitive Services account deployment model."
-                          }
-                        },
-                        "sku": {
-                          "type": "object",
-                          "properties": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the resource model definition representing SKU."
-                              }
-                            },
-                            "capacity": {
-                              "type": "int",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The capacity of the resource model definition representing SKU."
-                              }
-                            },
-                            "tier": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The tier of the resource model definition representing SKU."
-                              }
-                            },
-                            "size": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The size of the resource model definition representing SKU."
-                              }
-                            },
-                            "family": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The family of the resource model definition representing SKU."
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource model definition representing SKU."
-                          }
-                        },
-                        "raiPolicyName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of RAI policy."
-                          }
-                        },
-                        "versionUpgradeOption": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The version upgrade option."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a cognitive services account deployment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "baseName": {
-                      "type": "string",
-                      "minLength": 3,
-                      "maxLength": 12,
-                      "metadata": {
-                        "description": "Required. A friendly application/environment name to serve as the \"base\" when using the default naming for all resources in this deployment."
-                      }
-                    },
-                    "baseUniqueName": {
-                      "type": "string",
-                      "defaultValue": "[substring(uniqueString(subscription().id, resourceGroup().name, parameters('baseName')), 0, 5)]",
-                      "maxLength": 5,
-                      "metadata": {
-                        "description": "Optional. A unique text value for the application/environment. This is used to ensure resource names are unique for global resources. Defaults to a 5-character substring of the unique string generated from the subscription ID, resource group name, and base name."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources. Defaults to the location of the resource group."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "aiModelDeployments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/deploymentType"
-                      },
-                      "defaultValue": [],
-                      "metadata": {
-                        "description": "Optional. Specifies the OpenAI deployments to create."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                        },
-                        "description": "Optional. Specifies the resource tags for all the resources."
-                      },
-                      "defaultValue": {}
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the AI resources."
-                      }
-                    },
-                    "includeAssociatedResources": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Whether to include associated resources: Key Vault, AI Search, Storage Account, and Cosmos DB. If true, these resources will be created. Optionally, existing resources of these types can be supplied in their respective parameters. Defaults to false."
-                      }
-                    },
-                    "privateEndpointSubnetResourceId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The Resource ID of the subnet to establish Private Endpoint(s). If provided, private endpoints will be created for the AI Foundry account and associated resources when creating those resource. Each resource will also require supplied private DNS zone resource ID(s) to establish those private endpoints."
-                      }
-                    },
-                    "aiFoundryConfiguration": {
-                      "$ref": "#/definitions/foundryConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom configuration for the AI Foundry."
-                      }
-                    },
-                    "keyVaultConfiguration": {
-                      "$ref": "#/definitions/resourceConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom configuration for the Key Vault."
-                      }
-                    },
-                    "aiSearchConfiguration": {
-                      "$ref": "#/definitions/resourceConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom configuration for the AI Search resource."
-                      }
-                    },
-                    "storageAccountConfiguration": {
-                      "$ref": "#/definitions/storageAccountConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom configuration for the Storage Account."
-                      }
-                    },
-                    "cosmosDbConfiguration": {
-                      "$ref": "#/definitions/resourceConfigurationType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Custom configuration for the Cosmos DB Account."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "resourcesName": "[toLower(trim(replace(replace(replace(replace(replace(replace(format('{0}{1}', parameters('baseName'), parameters('baseUniqueName')), '-', ''), '_', ''), '.', ''), '/', ''), ' ', ''), '*', '')))]",
-                    "projectName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'name'))), parameters('aiFoundryConfiguration').project.name, format('proj-{0}', variables('resourcesName')))]",
-                    "createCapabilityHosts": "[and(coalesce(tryGet(parameters('aiFoundryConfiguration'), 'createCapabilityHosts'), false()), parameters('includeAssociatedResources'))]"
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.ptn.aiml-aifoundry.{0}.{1}', replace('0.5.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "foundryAccount": {
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('module.account.{0}', variables('resourcesName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'accountName'))), createObject('value', parameters('aiFoundryConfiguration').accountName), createObject('value', format('ai{0}', variables('resourcesName'))))]",
-                          "location": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'location'))), createObject('value', parameters('aiFoundryConfiguration').location), createObject('value', parameters('location')))]",
-                          "sku": "[if(not(empty(tryGet(parameters('aiFoundryConfiguration'), 'sku'))), createObject('value', parameters('aiFoundryConfiguration').sku), createObject('value', 'S0'))]",
-                          "disableLocalAuth": {
-                            "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'disableLocalAuth'), true())]"
-                          },
-                          "allowProjectManagement": {
-                            "value": "[coalesce(tryGet(parameters('aiFoundryConfiguration'), 'allowProjectManagement'), true())]"
-                          },
-                          "aiModelDeployments": {
-                            "value": "[parameters('aiModelDeployments')]"
-                          },
-                          "privateEndpointSubnetResourceId": {
-                            "value": "[parameters('privateEndpointSubnetResourceId')]"
-                          },
-                          "agentSubnetResourceId": {
-                            "value": "[tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')]"
-                          },
-                          "privateDnsZoneResourceIds": "[if(and(not(empty(parameters('privateEndpointSubnetResourceId'))), not(empty(tryGet(parameters('aiFoundryConfiguration'), 'networking')))), createObject('value', createArray(parameters('aiFoundryConfiguration').networking.cognitiveServicesPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.openAiPrivateDnsZoneResourceId, parameters('aiFoundryConfiguration').networking.aiServicesPrivateDnsZoneResourceId)), createObject('value', createArray()))]",
-                          "roleAssignments": {
-                            "value": "[tryGet(parameters('aiFoundryConfiguration'), 'roleAssignments')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[parameters('enableTelemetry')]"
-                          },
-                          "lock": {
-                            "value": "[parameters('lock')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "11906964530752207086"
-                            }
-                          },
-                          "definitions": {
-                            "deploymentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of cognitive service account deployment."
-                                  }
-                                },
-                                "model": {
-                                  "type": "object",
-                                  "properties": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of Cognitive Services account deployment model."
-                                      }
-                                    },
-                                    "format": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The format of Cognitive Services account deployment model."
-                                      }
-                                    },
-                                    "version": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The version of Cognitive Services account deployment model."
-                                      }
-                                    }
-                                  },
-                                  "metadata": {
-                                    "description": "Required. Properties of Cognitive Services account deployment model."
-                                  }
-                                },
-                                "sku": {
-                                  "type": "object",
-                                  "properties": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the resource model definition representing SKU."
-                                      }
-                                    },
-                                    "capacity": {
-                                      "type": "int",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The capacity of the resource model definition representing SKU."
-                                      }
-                                    },
-                                    "tier": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The tier of the resource model definition representing SKU."
-                                      }
-                                    },
-                                    "size": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The size of the resource model definition representing SKU."
-                                      }
-                                    },
-                                    "family": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The family of the resource model definition representing SKU."
-                                      }
-                                    }
-                                  },
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The resource model definition representing SKU."
-                                  }
-                                },
-                                "raiPolicyName": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of RAI policy."
-                                  }
-                                },
-                                "versionUpgradeOption": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The version upgrade option."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "The type for a cognitive services account deployment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/res/cognitive-services/account:0.12.0"
-                                }
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                },
-                                "notes": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the notes of the lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            },
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The name of the AI Foundry resource."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The location for the AI Foundry resource."
-                              }
-                            },
-                            "sku": {
-                              "type": "string",
-                              "defaultValue": "S0",
-                              "allowedValues": [
-                                "C2",
-                                "C3",
-                                "C4",
-                                "F0",
-                                "F1",
-                                "S",
-                                "S0",
-                                "S1",
-                                "S10",
-                                "S2",
-                                "S3",
-                                "S4",
-                                "S5",
-                                "S6",
-                                "S7",
-                                "S8",
-                                "S9",
-                                "DC0"
-                              ],
-                              "metadata": {
-                                "description": "Optional. SKU of the AI Foundry / Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-                              }
-                            },
-                            "allowProjectManagement": {
-                              "type": "bool",
-                              "metadata": {
-                                "description": "Required. Whether to allow project management in AI Foundry. This is required to enable the AI Foundry UI and project management features."
-                              }
-                            },
-                            "privateEndpointSubnetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceIds' to establish private endpoints."
-                              }
-                            },
-                            "agentSubnetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource Id of an existing subnet to use for agent connectivity. This is required when using agents with private endpoints."
-                              }
-                            },
-                            "disableLocalAuth": {
-                              "type": "bool",
-                              "metadata": {
-                                "description": "Required. Allow only Azure AD authentication. Should be enabled for security reasons."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Specifies the role assignments for the AI Foundry resource."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of AI Foundry resources."
-                              }
-                            },
-                            "aiModelDeployments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/deploymentType"
-                              },
-                              "defaultValue": [],
-                              "metadata": {
-                                "description": "Optional. Specifies the OpenAI deployments to create."
-                              }
-                            },
-                            "privateDnsZoneResourceIds": {
-                              "type": "array",
-                              "items": {
-                                "type": "string"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. List of private DNS zone resource IDs to use for the AI Foundry resource. This is required when using private endpoints."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                                },
-                                "description": "Optional. Specifies the resource tags for all the resources."
-                              },
-                              "defaultValue": {}
-                            }
-                          },
-                          "variables": {
-                            "copy": [
-                              {
-                                "name": "privateDnsZoneResourceIdValues",
-                                "count": "[length(coalesce(parameters('privateDnsZoneResourceIds'), createArray()))]",
-                                "input": {
-                                  "privateDnsZoneResourceId": "[coalesce(parameters('privateDnsZoneResourceIds'), createArray())[copyIndex('privateDnsZoneResourceIdValues')]]"
-                                }
-                              }
-                            ],
-                            "privateNetworkingEnabled": "[and(not(empty(variables('privateDnsZoneResourceIdValues'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
-                          },
-                          "resources": {
-                            "foundryAccount": {
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('avm.res.cognitive-services.account.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "tags": {
-                                    "value": "[parameters('tags')]"
-                                  },
-                                  "sku": {
-                                    "value": "[parameters('sku')]"
-                                  },
-                                  "kind": {
-                                    "value": "AIServices"
-                                  },
-                                  "lock": {
-                                    "value": "[parameters('lock')]"
-                                  },
-                                  "allowProjectManagement": {
-                                    "value": "[parameters('allowProjectManagement')]"
-                                  },
-                                  "managedIdentities": {
-                                    "value": {
-                                      "systemAssigned": true
-                                    }
-                                  },
-                                  "deployments": {
-                                    "value": "[parameters('aiModelDeployments')]"
-                                  },
-                                  "customSubDomainName": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "disableLocalAuth": {
-                                    "value": "[parameters('disableLocalAuth')]"
-                                  },
-                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-                                  "networkAcls": {
-                                    "value": {
-                                      "defaultAction": "Allow",
-                                      "bypass": "AzureServices"
-                                    }
-                                  },
-                                  "networkInjections": "[if(and(variables('privateNetworkingEnabled'), not(empty(parameters('agentSubnetResourceId')))), createObject('value', createObject('scenario', 'agent', 'subnetResourceId', parameters('agentSubnetResourceId'), 'useMicrosoftManagedNetwork', false())), createObject('value', null()))]",
-                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', variables('privateDnsZoneResourceIdValues')), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
-                                  "enableTelemetry": {
-                                    "value": "[parameters('enableTelemetry')]"
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[parameters('roleAssignments')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "9381727816193702843"
-                                    },
-                                    "name": "Cognitive Services",
-                                    "description": "This module deploys a Cognitive Service."
-                                  },
-                                  "definitions": {
-                                    "privateEndpointOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The name of the private endpoint."
-                                          }
-                                        },
-                                        "resourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resource ID of the private endpoint."
-                                          }
-                                        },
-                                        "groupId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "The group Id for the private endpoint Group."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "fqdn": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "FQDN that resolves to private endpoint IP address."
-                                                }
-                                              },
-                                              "ipAddresses": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "string"
-                                                },
-                                                "metadata": {
-                                                  "description": "A list of private IP addresses of the private endpoint."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "The custom DNS configurations of the private endpoint."
-                                          }
-                                        },
-                                        "networkInterfaceResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for the private endpoint output."
-                                      }
-                                    },
-                                    "deploymentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of cognitive service account deployment."
-                                          }
-                                        },
-                                        "model": {
-                                          "type": "object",
-                                          "properties": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of Cognitive Services account deployment model."
-                                              }
-                                            },
-                                            "format": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The format of Cognitive Services account deployment model."
-                                              }
-                                            },
-                                            "version": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The version of Cognitive Services account deployment model."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Properties of Cognitive Services account deployment model."
-                                          }
-                                        },
-                                        "sku": {
-                                          "type": "object",
-                                          "properties": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the resource model definition representing SKU."
-                                              }
-                                            },
-                                            "capacity": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The capacity of the resource model definition representing SKU."
-                                              }
-                                            },
-                                            "tier": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The tier of the resource model definition representing SKU."
-                                              }
-                                            },
-                                            "size": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The size of the resource model definition representing SKU."
-                                              }
-                                            },
-                                            "family": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The family of the resource model definition representing SKU."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource model definition representing SKU."
-                                          }
-                                        },
-                                        "raiPolicyName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of RAI policy."
-                                          }
-                                        },
-                                        "versionUpgradeOption": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The version upgrade option."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for a cognitive services account deployment."
-                                      }
-                                    },
-                                    "endpointType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Type of the endpoint."
-                                          }
-                                        },
-                                        "endpoint": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "The endpoint URI."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for a cognitive services account endpoint."
-                                      }
-                                    },
-                                    "secretsExportConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "keyVaultResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
-                                          }
-                                        },
-                                        "accessKey1Name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name for the accessKey1 secret to create."
-                                          }
-                                        },
-                                        "accessKey2Name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name for the accessKey2 secret to create."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type of the secrets exported to the provided Key Vault."
-                                      }
-                                    },
-                                    "commitmentPlanType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "autoRenew": {
-                                          "type": "bool",
-                                          "metadata": {
-                                            "description": "Required. Whether the plan should auto-renew at the end of the current commitment period."
-                                          }
-                                        },
-                                        "current": {
-                                          "type": "object",
-                                          "properties": {
-                                            "count": {
-                                              "type": "int",
-                                              "metadata": {
-                                                "description": "Required. The number of committed instances (e.g., number of containers or cores)."
-                                              }
-                                            },
-                                            "tier": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The tier of the commitment plan (e.g., T1, T2)."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The current commitment configuration."
-                                          }
-                                        },
-                                        "hostingModel": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The hosting model for the commitment plan. (e.g., DisconnectedContainer, ConnectedContainer, ProvisionedWeb, Web)."
-                                          }
-                                        },
-                                        "planType": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The plan type indicating which capability the plan applies to (e.g., NTTS, STT, CUSTOMSTT, ADDON)."
-                                          }
-                                        },
-                                        "commitmentPlanGuid": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The unique identifier of an existing commitment plan to update. Set to null to create a new plan."
-                                          }
-                                        },
-                                        "next": {
-                                          "type": "object",
-                                          "properties": {
-                                            "count": {
-                                              "type": "int",
-                                              "metadata": {
-                                                "description": "Required. The number of committed instances for the next period."
-                                              }
-                                            },
-                                            "tier": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The tier for the next commitment period."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The configuration of the next commitment period, if scheduled."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for a disconnected container commitment plan."
-                                      }
-                                    },
-                                    "networkInjectionType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "scenario": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "agent",
-                                            "none"
-                                          ],
-                                          "metadata": {
-                                            "description": "Required. The scenario for the network injection."
-                                          }
-                                        },
-                                        "subnetResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The Resource ID of the subnet on the Virtual Network on which to inject."
-                                          }
-                                        },
-                                        "useMicrosoftManagedNetwork": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Whether to use Microsoft Managed Network. Defaults to false."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "Type for network configuration in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
-                                      }
-                                    },
-                                    "_1.secretSetOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "secretResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resourceId of the exported secret."
-                                          }
-                                        },
-                                        "secretUri": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The secret URI of the exported secret."
-                                          }
-                                        },
-                                        "secretUriWithVersion": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The secret URI with version of the exported secret."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "_2.lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_2.privateEndpointCustomDnsConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "fqdn": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                          }
-                                        },
-                                        "ipAddresses": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of private IP addresses of the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_2.privateEndpointIpConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the resource that is unique within a resource group."
-                                          }
-                                        },
-                                        "properties": {
-                                          "type": "object",
-                                          "properties": {
-                                            "groupId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "memberName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "privateIPAddress": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Properties of private endpoint IP configurations."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_2.privateEndpointPrivateDnsZoneGroupType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private DNS Zone Group."
-                                          }
-                                        },
-                                        "privateDnsZoneGroupConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "name": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                                }
-                                              },
-                                              "privateDnsZoneResourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource id of the private DNS zone."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_2.roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "customerManagedKeyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "keyVaultResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                                          }
-                                        },
-                                        "keyName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the customer managed key to use for encryption."
-                                          }
-                                        },
-                                        "keyVersion": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, the deployment will use the latest version available at deployment time."
-                                          }
-                                        },
-                                        "userAssignedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type does not support auto-rotation of the customer-managed key.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "diagnosticSettingFullType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the diagnostic setting."
-                                          }
-                                        },
-                                        "logCategoriesAndGroups": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                }
-                                              },
-                                              "categoryGroup": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                          }
-                                        },
-                                        "metricCategories": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                          }
-                                        },
-                                        "logAnalyticsDestinationType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureDiagnostics",
-                                            "Dedicated"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                          }
-                                        },
-                                        "workspaceResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "storageAccountResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "eventHubAuthorizationRuleResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                          }
-                                        },
-                                        "eventHubName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "marketplacePartnerResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "managedIdentityAllType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "systemAssigned": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enables system assigned managed identity on the resource."
-                                          }
-                                        },
-                                        "userAssignedResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "privateEndpointSingleServiceType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private Endpoint."
-                                          }
-                                        },
-                                        "location": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The location to deploy the Private Endpoint to."
-                                          }
-                                        },
-                                        "privateLinkServiceConnectionName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private link connection to create."
-                                          }
-                                        },
-                                        "service": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                                          }
-                                        },
-                                        "subnetResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                          }
-                                        },
-                                        "resourceGroupResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                                          }
-                                        },
-                                        "privateDnsZoneGroup": {
-                                          "$ref": "#/definitions/_2.privateEndpointPrivateDnsZoneGroupType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                                          }
-                                        },
-                                        "isManualConnection": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. If Manual Private Link Connection is required."
-                                          }
-                                        },
-                                        "manualConnectionRequestMessage": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "maxLength": 140,
-                                          "metadata": {
-                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_2.privateEndpointCustomDnsConfigType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Custom DNS configurations."
-                                          }
-                                        },
-                                        "ipConfigurations": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_2.privateEndpointIpConfigurationType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                                          }
-                                        },
-                                        "applicationSecurityGroupResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                                          }
-                                        },
-                                        "customNetworkInterfaceName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                                          }
-                                        },
-                                        "lock": {
-                                          "$ref": "#/definitions/_2.lockType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_2.roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "__bicep_resource_derived_type!": {
-                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                                            },
-                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                                          }
-                                        },
-                                        "enableTelemetry": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable/Disable usage telemetry for module."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "secretsOutputType": {
-                                      "type": "object",
-                                      "properties": {},
-                                      "additionalProperties": {
-                                        "$ref": "#/definitions/_1.secretSetOutputType",
-                                        "metadata": {
-                                          "description": "An exported secret's references."
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "A map of the exported secrets",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of Cognitive Services account."
-                                      }
-                                    },
-                                    "kind": {
-                                      "type": "string",
-                                      "allowedValues": [
-                                        "AIServices",
-                                        "AnomalyDetector",
-                                        "CognitiveServices",
-                                        "ComputerVision",
-                                        "ContentModerator",
-                                        "ContentSafety",
-                                        "ConversationalLanguageUnderstanding",
-                                        "CustomVision.Prediction",
-                                        "CustomVision.Training",
-                                        "Face",
-                                        "FormRecognizer",
-                                        "HealthInsights",
-                                        "ImmersiveReader",
-                                        "Internal.AllInOne",
-                                        "LUIS",
-                                        "LUIS.Authoring",
-                                        "LanguageAuthoring",
-                                        "MetricsAdvisor",
-                                        "OpenAI",
-                                        "Personalizer",
-                                        "QnAMaker.v2",
-                                        "SpeechServices",
-                                        "TextAnalytics",
-                                        "TextTranslation"
-                                      ],
-                                      "metadata": {
-                                        "description": "Required. Kind of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-                                      }
-                                    },
-                                    "sku": {
-                                      "type": "string",
-                                      "defaultValue": "S0",
-                                      "allowedValues": [
-                                        "C2",
-                                        "C3",
-                                        "C4",
-                                        "F0",
-                                        "F1",
-                                        "S",
-                                        "S0",
-                                        "S1",
-                                        "S10",
-                                        "S2",
-                                        "S3",
-                                        "S4",
-                                        "S5",
-                                        "S6",
-                                        "S7",
-                                        "S8",
-                                        "S9",
-                                        "DC0"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. SKU of the Cognitive Services account. Use 'Get-AzCognitiveServicesAccountSku' to determine a valid combinations of 'kind' and 'SKU' for your Azure region."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "defaultValue": "[resourceGroup().location]",
-                                      "metadata": {
-                                        "description": "Optional. Location for all Resources."
-                                      }
-                                    },
-                                    "diagnosticSettings": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/diagnosticSettingFullType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The diagnostic settings of the service."
-                                      }
-                                    },
-                                    "publicNetworkAccess": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "Enabled",
-                                        "Disabled"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-                                      }
-                                    },
-                                    "customSubDomainName": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Conditional. Subdomain name used for token-based authentication. Required if 'networkAcls' or 'privateEndpoints' are set."
-                                      }
-                                    },
-                                    "networkAcls": {
-                                      "type": "object",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. A collection of rules governing the accessibility from specific network locations."
-                                      }
-                                    },
-                                    "networkInjections": {
-                                      "$ref": "#/definitions/networkInjectionType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Specifies in AI Foundry where virtual network injection occurs to secure scenarios like Agents entirely within a private network."
-                                      }
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                                      }
-                                    },
-                                    "lock": {
-                                      "$ref": "#/definitions/lockType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The lock settings of the service."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Tags of the resource."
-                                      }
-                                    },
-                                    "allowedFqdnList": {
-                                      "type": "array",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. List of allowed FQDN."
-                                      }
-                                    },
-                                    "apiProperties": {
-                                      "type": "object",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The API properties for special APIs."
-                                      }
-                                    },
-                                    "disableLocalAuth": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Allow only Azure AD authentication. Should be enabled for security reasons."
-                                      }
-                                    },
-                                    "customerManagedKey": {
-                                      "$ref": "#/definitions/customerManagedKeyType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The customer managed key definition."
-                                      }
-                                    },
-                                    "dynamicThrottlingEnabled": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. The flag to enable dynamic throttling."
-                                      }
-                                    },
-                                    "migrationToken": {
-                                      "type": "securestring",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Resource migration token."
-                                      }
-                                    },
-                                    "restore": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Restore a soft-deleted cognitive service at deployment time. Will fail if no such soft-deleted resource exists."
-                                      }
-                                    },
-                                    "restrictOutboundNetworkAccess": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Restrict outbound network access."
-                                      }
-                                    },
-                                    "userOwnedStorage": {
-                                      "type": "array",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.CognitiveServices/accounts@2025-04-01-preview#properties/properties/properties/userOwnedStorage"
-                                        },
-                                        "description": "Optional. The storage accounts for this resource."
-                                      },
-                                      "nullable": true
-                                    },
-                                    "managedIdentities": {
-                                      "$ref": "#/definitions/managedIdentityAllType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The managed identity definition for this resource."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    },
-                                    "deployments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/deploymentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of deployments about cognitive service accounts to create."
-                                      }
-                                    },
-                                    "secretsExportConfiguration": {
-                                      "$ref": "#/definitions/secretsExportConfigurationType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
-                                      }
-                                    },
-                                    "allowProjectManagement": {
-                                      "type": "bool",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable project management feature for AI Foundry."
-                                      }
-                                    },
-                                    "commitmentPlans": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/commitmentPlanType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Commitment plans to deploy for the cognitive services account."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "enableReferencedModulesTelemetry": false,
-                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                                    "builtInRoleNames": {
-                                      "Cognitive Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '25fbc0a9-bd7c-42a3-aa1a-3b75d497ee68')]",
-                                      "Cognitive Services Custom Vision Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c1ff6cc2-c111-46fe-8896-e0ef812ad9f3')]",
-                                      "Cognitive Services Custom Vision Deployment": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5c4089e1-6d96-4d2f-b296-c1bc7137275f')]",
-                                      "Cognitive Services Custom Vision Labeler": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '88424f51-ebe7-446f-bc41-7fa16989e96c')]",
-                                      "Cognitive Services Custom Vision Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '93586559-c37d-4a6b-ba08-b9f0940c2d73')]",
-                                      "Cognitive Services Custom Vision Trainer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a5ae4ab-0d65-4eeb-be61-29fc9b54394b')]",
-                                      "Cognitive Services Data Reader (Preview)": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b59867f0-fa02-499b-be73-45a86b5b3e1c')]",
-                                      "Cognitive Services Face Recognizer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '9894cab4-e18a-44aa-828b-cb588cd6f2d7')]",
-                                      "Cognitive Services Immersive Reader User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b2de6794-95db-4659-8781-7e080d3f2b9d')]",
-                                      "Cognitive Services Language Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f07febfe-79bc-46b1-8b37-790e26e6e498')]",
-                                      "Cognitive Services Language Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7628b7b8-a8b2-4cdc-b46f-e9b35248918e')]",
-                                      "Cognitive Services Language Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2310ca1-dc64-4889-bb49-c8e0fa3d47a8')]",
-                                      "Cognitive Services LUIS Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f72c8140-2111-481c-87ff-72b910f6e3f8')]",
-                                      "Cognitive Services LUIS Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18e81cdc-4e98-4e29-a639-e7d10c5a6226')]",
-                                      "Cognitive Services LUIS Writer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '6322a993-d5c9-4bed-b113-e49bbea25b27')]",
-                                      "Cognitive Services Metrics Advisor Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'cb43c632-a144-4ec5-977c-e80c4affc34a')]",
-                                      "Cognitive Services Metrics Advisor User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3b20f47b-3825-43cb-8114-4bd2201156a8')]",
-                                      "Cognitive Services OpenAI Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a001fd3d-188f-4b5d-821b-7da978bf7442')]",
-                                      "Cognitive Services OpenAI User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5e0bd9bd-7b93-4f28-af87-19fc36ad61bd')]",
-                                      "Cognitive Services QnA Maker Editor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f4cc2bf9-21be-47a1-bdf1-5c5804381025')]",
-                                      "Cognitive Services QnA Maker Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '466ccd10-b268-4a11-b098-b4849f024126')]",
-                                      "Cognitive Services Speech Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0e75ca1e-0464-4b4d-8b93-68208a576181')]",
-                                      "Cognitive Services Speech User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f2dc8367-1007-4938-bd23-fe263f013447')]",
-                                      "Cognitive Services User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
-                                      "Azure AI Developer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '64702f94-c441-49e6-a78b-ef80e0188fee')]",
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "cMKKeyVault::cMKKey": {
-                                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-                                      "existing": true,
-                                      "type": "Microsoft.KeyVault/vaults/keys",
-                                      "apiVersion": "2024-11-01",
-                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
-                                    },
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.cognitiveservices-account.{0}.{1}', replace('0.13.2', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "cMKKeyVault": {
-                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-                                      "existing": true,
-                                      "type": "Microsoft.KeyVault/vaults",
-                                      "apiVersion": "2024-11-01",
-                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
-                                    },
-                                    "cMKUserAssignedIdentity": {
-                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-                                      "existing": true,
-                                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-                                      "apiVersion": "2025-01-31-preview",
-                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-                                    },
-                                    "cognitiveService": {
-                                      "type": "Microsoft.CognitiveServices/accounts",
-                                      "apiVersion": "2025-06-01",
-                                      "name": "[parameters('name')]",
-                                      "kind": "[parameters('kind')]",
-                                      "identity": "[variables('identity')]",
-                                      "location": "[parameters('location')]",
-                                      "tags": "[parameters('tags')]",
-                                      "sku": {
-                                        "name": "[parameters('sku')]"
-                                      },
-                                      "properties": {
-                                        "allowProjectManagement": "[parameters('allowProjectManagement')]",
-                                        "customSubDomainName": "[parameters('customSubDomainName')]",
-                                        "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
-                                        "networkInjections": "[if(not(empty(parameters('networkInjections'))), createArray(createObject('scenario', tryGet(parameters('networkInjections'), 'scenario'), 'subnetArmId', tryGet(parameters('networkInjections'), 'subnetResourceId'), 'useMicrosoftManagedNetwork', coalesce(tryGet(parameters('networkInjections'), 'useMicrosoftManagedNetwork'), false()))), null())]",
-                                        "publicNetworkAccess": "[if(not(equals(parameters('publicNetworkAccess'), null())), parameters('publicNetworkAccess'), if(not(empty(parameters('networkAcls'))), 'Enabled', 'Disabled'))]",
-                                        "allowedFqdnList": "[parameters('allowedFqdnList')]",
-                                        "apiProperties": "[parameters('apiProperties')]",
-                                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
-                                        "encryption": "[if(not(empty(parameters('customerManagedKey'))), createObject('keySource', 'Microsoft.KeyVault', 'keyVaultProperties', createObject('identityClientId', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), ''))), reference('cMKUserAssignedIdentity').clientId, null()), 'keyVaultUri', reference('cMKKeyVault').vaultUri, 'keyName', parameters('customerManagedKey').keyName, 'keyVersion', if(not(empty(coalesce(tryGet(parameters('customerManagedKey'), 'keyVersion'), ''))), tryGet(parameters('customerManagedKey'), 'keyVersion'), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null())]",
-                                        "migrationToken": "[parameters('migrationToken')]",
-                                        "restore": "[parameters('restore')]",
-                                        "restrictOutboundNetworkAccess": "[parameters('restrictOutboundNetworkAccess')]",
-                                        "userOwnedStorage": "[if(not(empty(parameters('userOwnedStorage'))), parameters('userOwnedStorage'), null())]",
-                                        "dynamicThrottlingEnabled": "[parameters('dynamicThrottlingEnabled')]"
-                                      },
-                                      "dependsOn": [
-                                        "cMKKeyVault",
-                                        "cMKKeyVault::cMKKey",
-                                        "cMKUserAssignedIdentity"
-                                      ]
-                                    },
-                                    "cognitiveService_deployments": {
-                                      "copy": {
-                                        "name": "cognitiveService_deployments",
-                                        "count": "[length(coalesce(parameters('deployments'), createArray()))]",
-                                        "mode": "serial",
-                                        "batchSize": 1
-                                      },
-                                      "type": "Microsoft.CognitiveServices/accounts/deployments",
-                                      "apiVersion": "2025-06-01",
-                                      "name": "[format('{0}/{1}', parameters('name'), coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'name'), format('{0}-deployments', parameters('name'))))]",
-                                      "properties": {
-                                        "model": "[coalesce(parameters('deployments'), createArray())[copyIndex()].model]",
-                                        "raiPolicyName": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'raiPolicyName')]",
-                                        "versionUpgradeOption": "[tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'versionUpgradeOption')]"
-                                      },
-                                      "sku": "[coalesce(tryGet(coalesce(parameters('deployments'), createArray())[copyIndex()], 'sku'), createObject('name', parameters('sku'), 'capacity', tryGet(parameters('sku'), 'capacity'), 'tier', tryGet(parameters('sku'), 'tier'), 'size', tryGet(parameters('sku'), 'size'), 'family', tryGet(parameters('sku'), 'family')))]",
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    },
-                                    "cognitiveService_lock": {
-                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                      "type": "Microsoft.Authorization/locks",
-                                      "apiVersion": "2020-05-01",
-                                      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                      "properties": {
-                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                                      },
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    },
-                                    "cognitiveService_commitmentPlans": {
-                                      "copy": {
-                                        "name": "cognitiveService_commitmentPlans",
-                                        "count": "[length(coalesce(parameters('commitmentPlans'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.CognitiveServices/accounts/commitmentPlans",
-                                      "apiVersion": "2025-06-01",
-                                      "name": "[format('{0}/{1}', parameters('name'), format('{0}-{1}', coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].hostingModel, coalesce(parameters('commitmentPlans'), createArray())[copyIndex()].planType))]",
-                                      "properties": "[coalesce(parameters('commitmentPlans'), createArray())[copyIndex()]]",
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    },
-                                    "cognitiveService_diagnosticSettings": {
-                                      "copy": {
-                                        "name": "cognitiveService_diagnosticSettings",
-                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Insights/diagnosticSettings",
-                                      "apiVersion": "2021-05-01-preview",
-                                      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                                      "properties": {
-                                        "copy": [
-                                          {
-                                            "name": "metrics",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                            "input": {
-                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                              "timeGrain": null
-                                            }
-                                          },
-                                          {
-                                            "name": "logs",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                            "input": {
-                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                            }
-                                          }
-                                        ],
-                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                      },
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    },
-                                    "cognitiveService_roleAssignments": {
-                                      "copy": {
-                                        "name": "cognitiveService_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    },
-                                    "cognitiveService_privateEndpoints": {
-                                      "copy": {
-                                        "name": "cognitiveService_privateEndpoints",
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-cognitiveService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex()))]"
-                                          },
-                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')))))), createObject('value', null()))]",
-                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.CognitiveServices/accounts', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'account')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                                          "subnetResourceId": {
-                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          },
-                                          "location": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                                          },
-                                          "lock": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                                          },
-                                          "privateDnsZoneGroup": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "customDnsConfigs": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                                          },
-                                          "ipConfigurations": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                                          },
-                                          "applicationSecurityGroupResourceIds": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                                          },
-                                          "customNetworkInterfaceName": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.34.44.8038",
-                                              "templateHash": "12389807800450456797"
-                                            },
-                                            "name": "Private Endpoints",
-                                            "description": "This module deploys a Private Endpoint."
-                                          },
-                                          "definitions": {
-                                            "privateDnsZoneGroupType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                                  }
-                                                },
-                                                "privateDnsZoneGroupConfigs": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "ipConfigurationType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "memberName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "privateIPAddress": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private endpoint IP configurations."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "privateLinkServiceConnectionType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the private link service connection."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupIds": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                                      }
-                                                    },
-                                                    "privateLinkServiceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The resource id of private link service."
-                                                      }
-                                                    },
-                                                    "requestMessage": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private link service connection."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "customDnsConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "fqdn": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                                  }
-                                                },
-                                                "ipAddresses": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "lockType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the name of lock."
-                                                  }
-                                                },
-                                                "kind": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "CanNotDelete",
-                                                    "None",
-                                                    "ReadOnly"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the type of lock."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a lock.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            },
-                                            "privateDnsZoneGroupConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the private DNS zone group config."
-                                                  }
-                                                },
-                                                "privateDnsZoneResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The resource id of the private DNS zone."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                                }
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the private endpoint resource to create."
-                                              }
-                                            },
-                                            "subnetResourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                              }
-                                            },
-                                            "applicationSecurityGroupResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                              }
-                                            },
-                                            "customNetworkInterfaceName": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                              }
-                                            },
-                                            "ipConfigurations": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/ipConfigurationType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                              }
-                                            },
-                                            "privateDnsZoneGroup": {
-                                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                              }
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "defaultValue": "[resourceGroup().location]",
-                                              "metadata": {
-                                                "description": "Optional. Location for all Resources."
-                                              }
-                                            },
-                                            "lock": {
-                                              "$ref": "#/definitions/lockType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The lock settings of the service."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                              }
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Custom DNS configurations."
-                                              }
-                                            },
-                                            "manualPrivateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "privateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint": {
-                                              "type": "Microsoft.Network/privateEndpoints",
-                                              "apiVersion": "2024-05-01",
-                                              "name": "[parameters('name')]",
-                                              "location": "[parameters('location')]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "applicationSecurityGroups",
-                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                                    "input": {
-                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                                    }
-                                                  }
-                                                ],
-                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                                "subnet": {
-                                                  "id": "[parameters('subnetResourceId')]"
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint_lock": {
-                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                              "type": "Microsoft.Authorization/locks",
-                                              "apiVersion": "2020-05-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                              "properties": {
-                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_roleAssignments": {
-                                              "copy": {
-                                                "name": "privateEndpoint_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_privateDnsZoneGroup": {
-                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                                  },
-                                                  "privateEndpointName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "privateDnsZoneConfigs": {
-                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.34.44.8038",
-                                                      "templateHash": "13997305779829540948"
-                                                    },
-                                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                                  },
-                                                  "definitions": {
-                                                    "privateDnsZoneGroupConfigType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name of the private DNS zone group config."
-                                                          }
-                                                        },
-                                                        "privateDnsZoneResourceId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The resource id of the private DNS zone."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "__bicep_export!": true
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "privateEndpointName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "privateDnsZoneConfigs": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                      },
-                                                      "minLength": 1,
-                                                      "maxLength": 5,
-                                                      "metadata": {
-                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Optional. The name of the private DNS zone group."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "privateDnsZoneConfigsVar",
-                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                                        "input": {
-                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                                          "properties": {
-                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                                          }
-                                                        }
-                                                      }
-                                                    ]
-                                                  },
-                                                  "resources": {
-                                                    "privateEndpoint": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Network/privateEndpoints",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[parameters('privateEndpointName')]"
-                                                    },
-                                                    "privateDnsZoneGroup": {
-                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group the private endpoint was deployed into."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the private endpoint."
-                                              },
-                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the private endpoint."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The location the resource was deployed into."
-                                              },
-                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "metadata": {
-                                                "description": "The custom DNS configurations of the private endpoint."
-                                              },
-                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                                            },
-                                            "networkInterfaceResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "metadata": {
-                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                                              },
-                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                                            },
-                                            "groupId": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "The group Id for the private endpoint Group."
-                                              },
-                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    },
-                                    "secretsExport": {
-                                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
-                                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "keyVaultName": {
-                                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
-                                          },
-                                          "secretsToSet": {
-                                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('cognitiveService', '2025-06-01').key1)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('cognitiveService', '2025-06-01').key2)), createArray()))]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "10828079590669389085"
-                                            }
-                                          },
-                                          "definitions": {
-                                            "secretSetOutputType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "secretResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The resourceId of the exported secret."
-                                                  }
-                                                },
-                                                "secretUri": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The secret URI of the exported secret."
-                                                  }
-                                                },
-                                                "secretUriWithVersion": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The secret URI with version of the exported secret."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            },
-                                            "secretToSetType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the secret to set."
-                                                  }
-                                                },
-                                                "value": {
-                                                  "type": "securestring",
-                                                  "metadata": {
-                                                    "description": "Required. The value of the secret to set."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "keyVaultName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the Key Vault to set the ecrets in."
-                                              }
-                                            },
-                                            "secretsToSet": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/secretToSetType"
-                                              },
-                                              "metadata": {
-                                                "description": "Required. The secrets to set in the Key Vault."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "keyVault": {
-                                              "existing": true,
-                                              "type": "Microsoft.KeyVault/vaults",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[parameters('keyVaultName')]"
-                                            },
-                                            "secrets": {
-                                              "copy": {
-                                                "name": "secrets",
-                                                "count": "[length(parameters('secretsToSet'))]"
-                                              },
-                                              "type": "Microsoft.KeyVault/vaults/secrets",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
-                                              "properties": {
-                                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "secretsSet": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/secretSetOutputType"
-                                              },
-                                              "metadata": {
-                                                "description": "The references to the secrets exported to the provided Key Vault."
-                                              },
-                                              "copy": {
-                                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
-                                                "input": {
-                                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
-                                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
-                                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
-                                                }
-                                              }
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "cognitiveService"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the cognitive services account."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the cognitive services account."
-                                      },
-                                      "value": "[resourceId('Microsoft.CognitiveServices/accounts', parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group the cognitive services account was deployed into."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    },
-                                    "endpoint": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The service endpoint of the cognitive services account."
-                                      },
-                                      "value": "[reference('cognitiveService').endpoint]"
-                                    },
-                                    "endpoints": {
-                                      "$ref": "#/definitions/endpointType",
-                                      "metadata": {
-                                        "description": "All endpoints available for the cognitive services account, types depends on the cognitive service kind."
-                                      },
-                                      "value": "[reference('cognitiveService').endpoints]"
-                                    },
-                                    "systemAssignedMIPrincipalId": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "The principal ID of the system assigned identity."
-                                      },
-                                      "value": "[tryGet(tryGet(reference('cognitiveService', '2025-06-01', 'full'), 'identity'), 'principalId')]"
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The location the resource was deployed into."
-                                      },
-                                      "value": "[reference('cognitiveService', '2025-06-01', 'full').location]"
-                                    },
-                                    "exportedSecrets": {
-                                      "$ref": "#/definitions/secretsOutputType",
-                                      "metadata": {
-                                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
-                                      },
-                                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The private endpoints of the congitive services account."
-                                      },
-                                      "copy": {
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                                        "input": {
-                                          "name": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                                          "resourceId": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                                          "groupId": "[tryGet(tryGet(reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                                          "customDnsConfigs": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                                          "networkInterfaceResourceIds": "[reference(format('cognitiveService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                                        }
-                                      }
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the AI Foundry resource."
-                              },
-                              "value": "[reference('foundryAccount').outputs.name.value]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource ID of the AI Foundry resource."
-                              },
-                              "value": "[reference('foundryAccount').outputs.resourceId.value]"
-                            },
-                            "subscriptionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Subscription ID of the AI Foundry resource."
-                              },
-                              "value": "[subscription().subscriptionId]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource Group Name of the AI Foundry resource."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Location of the AI Foundry resource."
-                              },
-                              "value": "[parameters('location')]"
-                            },
-                            "systemAssignedMIPrincipalId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "System assigned managed identity principal ID of the AI Foundry resource."
-                              },
-                              "value": "[reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "keyVault": {
-                      "condition": "[parameters('includeAssociatedResources')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('module.keyVault.{0}', variables('resourcesName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "existingResourceId": {
-                            "value": "[tryGet(parameters('keyVaultConfiguration'), 'existingResourceId')]"
-                          },
-                          "name": {
-                            "value": "[take(if(and(not(empty(parameters('keyVaultConfiguration'))), not(empty(tryGet(parameters('keyVaultConfiguration'), 'name')))), parameters('keyVaultConfiguration').name, format('kv{0}', variables('resourcesName'))), 24)]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[parameters('enableTelemetry')]"
-                          },
-                          "privateEndpointSubnetResourceId": {
-                            "value": "[parameters('privateEndpointSubnetResourceId')]"
-                          },
-                          "privateDnsZoneResourceId": {
-                            "value": "[tryGet(parameters('keyVaultConfiguration'), 'privateDnsZoneResourceId')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(parameters('keyVaultConfiguration'), 'roleAssignments')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "9899473530932390252"
-                            }
-                          },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "functions": [
-                            {
-                              "namespace": "__bicep",
-                              "members": {
-                                "getResourceGroupName": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Group Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceName": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    },
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceParts": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
-                                  },
-                                  "metadata": {
-                                    "description": "Splits Resource ID into its components.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getSubscriptionId": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Subscription ID from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          ],
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Required. The name of the Key Vault."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The location for the Key Vault."
-                              }
-                            },
-                            "existingResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The full resource ID of an existing Key Vault to use instead of creating a new one."
-                              }
-                            },
-                            "privateEndpointSubnetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints."
-                              }
-                            },
-                            "privateDnsZoneResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the private DNS zone for the Key Vault to establish private endpoints."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Specifies the role assignments for the Key Vault."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                                },
-                                "description": "Optional. Specifies the resource tags for all the resources."
-                              },
-                              "defaultValue": {}
-                            }
-                          },
-                          "variables": {
-                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
-                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
-                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
-                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
-                            "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
-                          },
-                          "resources": {
-                            "existingKeyVault": {
-                              "condition": "[not(empty(parameters('existingResourceId')))]",
-                              "existing": true,
-                              "type": "Microsoft.KeyVault/vaults",
-                              "apiVersion": "2024-11-01",
-                              "subscriptionId": "[variables('existingSubscriptionId')]",
-                              "resourceGroup": "[variables('existingResourceGroupName')]",
-                              "name": "[variables('existingName')]"
-                            },
-                            "keyVault": {
-                              "condition": "[empty(parameters('existingResourceId'))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('avm.res.key-vault.vault.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "tags": {
-                                    "value": "[parameters('tags')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[parameters('enableTelemetry')]"
-                                  },
-                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-                                  "networkAcls": {
-                                    "value": {
-                                      "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]"
-                                    }
-                                  },
-                                  "enableVaultForDeployment": {
-                                    "value": true
-                                  },
-                                  "enableVaultForDiskEncryption": {
-                                    "value": true
-                                  },
-                                  "enableVaultForTemplateDeployment": {
-                                    "value": true
-                                  },
-                                  "enablePurgeProtection": {
-                                    "value": false
-                                  },
-                                  "enableRbacAuthorization": {
-                                    "value": true
-                                  },
-                                  "enableSoftDelete": {
-                                    "value": true
-                                  },
-                                  "softDeleteRetentionInDays": {
-                                    "value": 7
-                                  },
-                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'vault', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
-                                  "roleAssignments": {
-                                    "value": "[parameters('roleAssignments')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "8811577289487069918"
-                                    },
-                                    "name": "Key Vaults",
-                                    "description": "This module deploys a Key Vault."
-                                  },
-                                  "definitions": {
-                                    "networkAclsType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "bypass": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureServices",
-                                            "None"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The bypass options for traffic for the network ACLs."
-                                          }
-                                        },
-                                        "defaultAction": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Allow",
-                                            "Deny"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The default action for the network ACLs, when no rule matches."
-                                          }
-                                        },
-                                        "ipRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "value": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. An IPv4 address range in CIDR notation, such as \"124.56.78.91\" (simple IP address) or \"124.56.78.0/24\"."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP rules."
-                                          }
-                                        },
-                                        "virtualNetworkRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "id": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource ID of the virtual network subnet."
-                                                }
-                                              },
-                                              "ignoreMissingVnetServiceEndpoint": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Whether NRP will ignore the check if parent subnet has serviceEndpoints configured."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of virtual network rules."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for rules governing the accessibility of the key vault from specific network locations."
-                                      }
-                                    },
-                                    "privateEndpointOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The name of the private endpoint."
-                                          }
-                                        },
-                                        "resourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resource ID of the private endpoint."
-                                          }
-                                        },
-                                        "groupId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "The group Id for the private endpoint Group."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "fqdn": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "FQDN that resolves to private endpoint IP address."
-                                                }
-                                              },
-                                              "ipAddresses": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "string"
-                                                },
-                                                "metadata": {
-                                                  "description": "A list of private IP addresses of the private endpoint."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "The custom DNS configurations of the private endpoint."
-                                          }
-                                        },
-                                        "networkInterfaceResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    },
-                                    "credentialOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "resourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The item's resourceId."
-                                          }
-                                        },
-                                        "uri": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The item's uri."
-                                          }
-                                        },
-                                        "uriWithVersion": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The item's uri with version."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for a credential output."
-                                      }
-                                    },
-                                    "accessPolicyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "tenantId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
-                                          }
-                                        },
-                                        "objectId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
-                                          }
-                                        },
-                                        "applicationId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Application ID of the client making request on behalf of a principal."
-                                          }
-                                        },
-                                        "permissions": {
-                                          "type": "object",
-                                          "properties": {
-                                            "keys": {
-                                              "type": "array",
-                                              "allowedValues": [
-                                                "all",
-                                                "backup",
-                                                "create",
-                                                "decrypt",
-                                                "delete",
-                                                "encrypt",
-                                                "get",
-                                                "getrotationpolicy",
-                                                "import",
-                                                "list",
-                                                "purge",
-                                                "recover",
-                                                "release",
-                                                "restore",
-                                                "rotate",
-                                                "setrotationpolicy",
-                                                "sign",
-                                                "unwrapKey",
-                                                "update",
-                                                "verify",
-                                                "wrapKey"
-                                              ],
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Permissions to keys."
-                                              }
-                                            },
-                                            "secrets": {
-                                              "type": "array",
-                                              "allowedValues": [
-                                                "all",
-                                                "backup",
-                                                "delete",
-                                                "get",
-                                                "list",
-                                                "purge",
-                                                "recover",
-                                                "restore",
-                                                "set"
-                                              ],
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Permissions to secrets."
-                                              }
-                                            },
-                                            "certificates": {
-                                              "type": "array",
-                                              "allowedValues": [
-                                                "all",
-                                                "backup",
-                                                "create",
-                                                "delete",
-                                                "deleteissuers",
-                                                "get",
-                                                "getissuers",
-                                                "import",
-                                                "list",
-                                                "listissuers",
-                                                "managecontacts",
-                                                "manageissuers",
-                                                "purge",
-                                                "recover",
-                                                "restore",
-                                                "setissuers",
-                                                "update"
-                                              ],
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Permissions to certificates."
-                                              }
-                                            },
-                                            "storage": {
-                                              "type": "array",
-                                              "allowedValues": [
-                                                "all",
-                                                "backup",
-                                                "delete",
-                                                "deletesas",
-                                                "get",
-                                                "getsas",
-                                                "list",
-                                                "listsas",
-                                                "purge",
-                                                "recover",
-                                                "regeneratekey",
-                                                "restore",
-                                                "set",
-                                                "setsas",
-                                                "update"
-                                              ],
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Permissions to storage accounts."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Permissions the identity has for keys, secrets and certificates."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for an access policy."
-                                      }
-                                    },
-                                    "secretType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the secret."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource tags."
-                                          }
-                                        },
-                                        "attributes": {
-                                          "type": "object",
-                                          "properties": {
-                                            "enabled": {
-                                              "type": "bool",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Defines whether the secret is enabled or disabled."
-                                              }
-                                            },
-                                            "exp": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Defines when the secret will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
-                                              }
-                                            },
-                                            "nbf": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. If set, defines the date from which onwards the secret becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Contains attributes of the secret."
-                                          }
-                                        },
-                                        "contentType": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The content type of the secret."
-                                          }
-                                        },
-                                        "value": {
-                                          "type": "securestring",
-                                          "metadata": {
-                                            "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for a secret output."
-                                      }
-                                    },
-                                    "keyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the key."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource tags."
-                                          }
-                                        },
-                                        "attributes": {
-                                          "type": "object",
-                                          "properties": {
-                                            "enabled": {
-                                              "type": "bool",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Defines whether the key is enabled or disabled."
-                                              }
-                                            },
-                                            "exp": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Defines when the key will become invalid. Defined in seconds since 1970-01-01T00:00:00Z."
-                                              }
-                                            },
-                                            "nbf": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. If set, defines the date from which onwards the key becomes valid. Defined in seconds since 1970-01-01T00:00:00Z."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Contains attributes of the key."
-                                          }
-                                        },
-                                        "curveName": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "P-256",
-                                            "P-256K",
-                                            "P-384",
-                                            "P-521"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The elliptic curve name. Only works if \"keySize\" equals \"EC\" or \"EC-HSM\". Default is \"P-256\"."
-                                          }
-                                        },
-                                        "keyOps": {
-                                          "type": "array",
-                                          "allowedValues": [
-                                            "decrypt",
-                                            "encrypt",
-                                            "import",
-                                            "release",
-                                            "sign",
-                                            "unwrapKey",
-                                            "verify",
-                                            "wrapKey"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The allowed operations on this key."
-                                          }
-                                        },
-                                        "keySize": {
-                                          "type": "int",
-                                          "allowedValues": [
-                                            2048,
-                                            3072,
-                                            4096
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The key size in bits. Only works if \"keySize\" equals \"RSA\" or \"RSA-HSM\". Default is \"4096\"."
-                                          }
-                                        },
-                                        "kty": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "EC",
-                                            "EC-HSM",
-                                            "RSA",
-                                            "RSA-HSM"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The type of the key. Default is \"EC\"."
-                                          }
-                                        },
-                                        "releasePolicy": {
-                                          "type": "object",
-                                          "properties": {
-                                            "contentType": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Content type and version of key release policy."
-                                              }
-                                            },
-                                            "data": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Blob encoding the policy rules under which the key can be released."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Key release policy."
-                                          }
-                                        },
-                                        "rotationPolicy": {
-                                          "$ref": "#/definitions/rotationPolicyType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Key rotation policy."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for a key."
-                                      }
-                                    },
-                                    "_1.privateEndpointCustomDnsConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "fqdn": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                          }
-                                        },
-                                        "ipAddresses": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of private IP addresses of the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointIpConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the resource that is unique within a resource group."
-                                          }
-                                        },
-                                        "properties": {
-                                          "type": "object",
-                                          "properties": {
-                                            "groupId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "memberName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "privateIPAddress": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Properties of private endpoint IP configurations."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private DNS Zone Group."
-                                          }
-                                        },
-                                        "privateDnsZoneGroupConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "name": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                                }
-                                              },
-                                              "privateDnsZoneResourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource id of the private DNS zone."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "diagnosticSettingFullType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the diagnostic setting."
-                                          }
-                                        },
-                                        "logCategoriesAndGroups": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                }
-                                              },
-                                              "categoryGroup": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                          }
-                                        },
-                                        "metricCategories": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                          }
-                                        },
-                                        "logAnalyticsDestinationType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureDiagnostics",
-                                            "Dedicated"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                          }
-                                        },
-                                        "workspaceResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "storageAccountResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "eventHubAuthorizationRuleResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                          }
-                                        },
-                                        "eventHubName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "marketplacePartnerResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "privateEndpointSingleServiceType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private Endpoint."
-                                          }
-                                        },
-                                        "location": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The location to deploy the Private Endpoint to."
-                                          }
-                                        },
-                                        "privateLinkServiceConnectionName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private link connection to create."
-                                          }
-                                        },
-                                        "service": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                                          }
-                                        },
-                                        "subnetResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                          }
-                                        },
-                                        "resourceGroupResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                                          }
-                                        },
-                                        "privateDnsZoneGroup": {
-                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                                          }
-                                        },
-                                        "isManualConnection": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. If Manual Private Link Connection is required."
-                                          }
-                                        },
-                                        "manualConnectionRequestMessage": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "maxLength": 140,
-                                          "metadata": {
-                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Custom DNS configurations."
-                                          }
-                                        },
-                                        "ipConfigurations": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                                          }
-                                        },
-                                        "applicationSecurityGroupResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                                          }
-                                        },
-                                        "customNetworkInterfaceName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                                          }
-                                        },
-                                        "lock": {
-                                          "$ref": "#/definitions/lockType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "__bicep_resource_derived_type!": {
-                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                                            },
-                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                                          }
-                                        },
-                                        "enableTelemetry": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable/Disable usage telemetry for module."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "rotationPolicyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "attributes": {
-                                          "type": "object",
-                                          "properties": {
-                                            "expiryTime": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The attributes of key rotation policy."
-                                          }
-                                        },
-                                        "lifetimeActions": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "action": {
-                                                "type": "object",
-                                                "properties": {
-                                                  "type": {
-                                                    "type": "string",
-                                                    "allowedValues": [
-                                                      "notify",
-                                                      "rotate"
-                                                    ],
-                                                    "nullable": true,
-                                                    "metadata": {
-                                                      "description": "Optional. The type of the action."
-                                                    }
-                                                  }
-                                                },
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The type of the action."
-                                                }
-                                              },
-                                              "trigger": {
-                                                "type": "object",
-                                                "properties": {
-                                                  "timeAfterCreate": {
-                                                    "type": "string",
-                                                    "nullable": true,
-                                                    "metadata": {
-                                                      "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
-                                                    }
-                                                  },
-                                                  "timeBeforeExpiry": {
-                                                    "type": "string",
-                                                    "nullable": true,
-                                                    "metadata": {
-                                                      "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
-                                                    }
-                                                  }
-                                                },
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The time duration for rotating the key."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The key rotation policy lifetime actions."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "The type for a rotation policy.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "key/main.bicep"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Required. Name of the Key Vault. Must be globally unique."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "defaultValue": "[resourceGroup().location]",
-                                      "metadata": {
-                                        "description": "Optional. Location for all resources."
-                                      }
-                                    },
-                                    "accessPolicies": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/accessPolicyType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. All access policies to create."
-                                      }
-                                    },
-                                    "secrets": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/secretType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. All secrets to create."
-                                      }
-                                    },
-                                    "keys": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/keyType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. All keys to create."
-                                      }
-                                    },
-                                    "enableVaultForDeployment": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Specifies if the vault is enabled for deployment by script or compute."
-                                      }
-                                    },
-                                    "enableVaultForTemplateDeployment": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Specifies if the vault is enabled for a template deployment."
-                                      }
-                                    },
-                                    "enableVaultForDiskEncryption": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Specifies if the azure platform has access to the vault for enabling disk encryption scenarios."
-                                      }
-                                    },
-                                    "enableSoftDelete": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Switch to enable/disable Key Vault's soft delete feature."
-                                      }
-                                    },
-                                    "softDeleteRetentionInDays": {
-                                      "type": "int",
-                                      "defaultValue": 90,
-                                      "metadata": {
-                                        "description": "Optional. softDelete data retention days. It accepts >=7 and <=90."
-                                      }
-                                    },
-                                    "enableRbacAuthorization": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. Note that management actions are always authorized with RBAC."
-                                      }
-                                    },
-                                    "createMode": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "allowedValues": [
-                                        "default",
-                                        "recover"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. The vault's create mode to indicate whether the vault need to be recovered or not."
-                                      }
-                                    },
-                                    "enablePurgeProtection": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Provide 'true' to enable Key Vault's purge protection feature."
-                                      }
-                                    },
-                                    "sku": {
-                                      "type": "string",
-                                      "defaultValue": "premium",
-                                      "allowedValues": [
-                                        "premium",
-                                        "standard"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Specifies the SKU for the vault."
-                                      }
-                                    },
-                                    "networkAcls": {
-                                      "$ref": "#/definitions/networkAclsType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Rules governing the accessibility of the resource from specific network locations."
-                                      }
-                                    },
-                                    "publicNetworkAccess": {
-                                      "type": "string",
-                                      "defaultValue": "",
-                                      "allowedValues": [
-                                        "",
-                                        "Enabled",
-                                        "Disabled"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-                                      }
-                                    },
-                                    "lock": {
-                                      "$ref": "#/definitions/lockType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The lock settings of the service."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.KeyVault/vaults@2024-11-01#properties/tags"
-                                        },
-                                        "description": "Optional. Resource tags."
-                                      },
-                                      "nullable": true
-                                    },
-                                    "diagnosticSettings": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/diagnosticSettingFullType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The diagnostic settings of the service."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      },
-                                      {
-                                        "name": "formattedAccessPolicies",
-                                        "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
-                                        "input": {
-                                          "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'applicationId'), '')]",
-                                          "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].objectId]",
-                                          "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')].permissions]",
-                                          "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('formattedAccessPolicies')], 'tenantId'), tenant().tenantId)]"
-                                        }
-                                      }
-                                    ],
-                                    "enableReferencedModulesTelemetry": false,
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
-                                      "Key Vault Certificates Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
-                                      "Key Vault Certificate User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db79e9a7-68ee-4b58-9aeb-b90e7c24fcba')]",
-                                      "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
-                                      "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
-                                      "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
-                                      "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
-                                      "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
-                                      "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
-                                      "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.keyvault-vault.{0}.{1}', replace('0.13.3', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "keyVault": {
-                                      "type": "Microsoft.KeyVault/vaults",
-                                      "apiVersion": "2024-11-01",
-                                      "name": "[parameters('name')]",
-                                      "location": "[parameters('location')]",
-                                      "tags": "[parameters('tags')]",
-                                      "properties": {
-                                        "enabledForDeployment": "[parameters('enableVaultForDeployment')]",
-                                        "enabledForTemplateDeployment": "[parameters('enableVaultForTemplateDeployment')]",
-                                        "enabledForDiskEncryption": "[parameters('enableVaultForDiskEncryption')]",
-                                        "enableSoftDelete": "[parameters('enableSoftDelete')]",
-                                        "softDeleteRetentionInDays": "[parameters('softDeleteRetentionInDays')]",
-                                        "enableRbacAuthorization": "[parameters('enableRbacAuthorization')]",
-                                        "createMode": "[parameters('createMode')]",
-                                        "enablePurgeProtection": "[if(parameters('enablePurgeProtection'), parameters('enablePurgeProtection'), null())]",
-                                        "tenantId": "[subscription().tenantId]",
-                                        "accessPolicies": "[variables('formattedAccessPolicies')]",
-                                        "sku": {
-                                          "name": "[parameters('sku')]",
-                                          "family": "A"
-                                        },
-                                        "networkAcls": "[if(not(empty(coalesce(parameters('networkAcls'), createObject()))), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass'), 'defaultAction', tryGet(parameters('networkAcls'), 'defaultAction'), 'virtualNetworkRules', coalesce(tryGet(parameters('networkAcls'), 'virtualNetworkRules'), createArray()), 'ipRules', coalesce(tryGet(parameters('networkAcls'), 'ipRules'), createArray())), null())]",
-                                        "publicNetworkAccess": "[if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(coalesce(parameters('privateEndpoints'), createArray()))), empty(coalesce(parameters('networkAcls'), createObject()))), 'Disabled', null()))]"
-                                      }
-                                    },
-                                    "keyVault_lock": {
-                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                      "type": "Microsoft.Authorization/locks",
-                                      "apiVersion": "2020-05-01",
-                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                      "properties": {
-                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    },
-                                    "keyVault_diagnosticSettings": {
-                                      "copy": {
-                                        "name": "keyVault_diagnosticSettings",
-                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Insights/diagnosticSettings",
-                                      "apiVersion": "2021-05-01-preview",
-                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                                      "properties": {
-                                        "copy": [
-                                          {
-                                            "name": "metrics",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                            "input": {
-                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                              "timeGrain": null
-                                            }
-                                          },
-                                          {
-                                            "name": "logs",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                            "input": {
-                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                            }
-                                          }
-                                        ],
-                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    },
-                                    "keyVault_roleAssignments": {
-                                      "copy": {
-                                        "name": "keyVault_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    },
-                                    "keyVault_accessPolicies": {
-                                      "condition": "[not(empty(parameters('accessPolicies')))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-KeyVault-AccessPolicies', uniqueString(deployment().name, parameters('location')))]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "keyVaultName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "accessPolicies": {
-                                            "value": "[parameters('accessPolicies')]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "8803020983329720581"
-                                            },
-                                            "name": "Key Vault Access Policies",
-                                            "description": "This module deploys a Key Vault Access Policy."
-                                          },
-                                          "definitions": {
-                                            "accessPoliciesType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "tenantId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The tenant ID that is used for authenticating requests to the key vault."
-                                                  }
-                                                },
-                                                "objectId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The object ID of a user, service principal or security group in the tenant for the vault."
-                                                  }
-                                                },
-                                                "applicationId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Application ID of the client making request on behalf of a principal."
-                                                  }
-                                                },
-                                                "permissions": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "keys": {
-                                                      "type": "array",
-                                                      "allowedValues": [
-                                                        "all",
-                                                        "backup",
-                                                        "create",
-                                                        "decrypt",
-                                                        "delete",
-                                                        "encrypt",
-                                                        "get",
-                                                        "getrotationpolicy",
-                                                        "import",
-                                                        "list",
-                                                        "purge",
-                                                        "recover",
-                                                        "release",
-                                                        "restore",
-                                                        "rotate",
-                                                        "setrotationpolicy",
-                                                        "sign",
-                                                        "unwrapKey",
-                                                        "update",
-                                                        "verify",
-                                                        "wrapKey"
-                                                      ],
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Permissions to keys."
-                                                      }
-                                                    },
-                                                    "secrets": {
-                                                      "type": "array",
-                                                      "allowedValues": [
-                                                        "all",
-                                                        "backup",
-                                                        "delete",
-                                                        "get",
-                                                        "list",
-                                                        "purge",
-                                                        "recover",
-                                                        "restore",
-                                                        "set"
-                                                      ],
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Permissions to secrets."
-                                                      }
-                                                    },
-                                                    "certificates": {
-                                                      "type": "array",
-                                                      "allowedValues": [
-                                                        "all",
-                                                        "backup",
-                                                        "create",
-                                                        "delete",
-                                                        "deleteissuers",
-                                                        "get",
-                                                        "getissuers",
-                                                        "import",
-                                                        "list",
-                                                        "listissuers",
-                                                        "managecontacts",
-                                                        "manageissuers",
-                                                        "purge",
-                                                        "recover",
-                                                        "restore",
-                                                        "setissuers",
-                                                        "update"
-                                                      ],
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Permissions to certificates."
-                                                      }
-                                                    },
-                                                    "storage": {
-                                                      "type": "array",
-                                                      "allowedValues": [
-                                                        "all",
-                                                        "backup",
-                                                        "delete",
-                                                        "deletesas",
-                                                        "get",
-                                                        "getsas",
-                                                        "list",
-                                                        "listsas",
-                                                        "purge",
-                                                        "recover",
-                                                        "regeneratekey",
-                                                        "restore",
-                                                        "set",
-                                                        "setsas",
-                                                        "update"
-                                                      ],
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Permissions to storage accounts."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Permissions the identity has for keys, secrets and certificates."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for an access policy."
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "keyVaultName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "accessPolicies": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/accessPoliciesType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. An array of 0 to 16 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault's tenant ID."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.keyvault-accesspolicy.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "keyVault": {
-                                              "existing": true,
-                                              "type": "Microsoft.KeyVault/vaults",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[parameters('keyVaultName')]"
-                                            },
-                                            "policies": {
-                                              "type": "Microsoft.KeyVault/vaults/accessPolicies",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'add')]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "accessPolicies",
-                                                    "count": "[length(coalesce(parameters('accessPolicies'), createArray()))]",
-                                                    "input": {
-                                                      "applicationId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'applicationId'), '')]",
-                                                      "objectId": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].objectId]",
-                                                      "permissions": "[coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')].permissions]",
-                                                      "tenantId": "[coalesce(tryGet(coalesce(parameters('accessPolicies'), createArray())[copyIndex('accessPolicies')], 'tenantId'), tenant().tenantId)]"
-                                                    }
-                                                  }
-                                                ]
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the access policies assignment was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the access policies assignment."
-                                              },
-                                              "value": "add"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the access policies assignment."
-                                              },
-                                              "value": "[resourceId('Microsoft.KeyVault/vaults/accessPolicies', parameters('keyVaultName'), 'add')]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    },
-                                    "keyVault_secrets": {
-                                      "copy": {
-                                        "name": "keyVault_secrets",
-                                        "count": "[length(coalesce(parameters('secrets'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-KeyVault-Secret-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].name]"
-                                          },
-                                          "value": {
-                                            "value": "[coalesce(parameters('secrets'), createArray())[copyIndex()].value]"
-                                          },
-                                          "keyVaultName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "attributesEnabled": {
-                                            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'enabled')]"
-                                          },
-                                          "attributesExp": {
-                                            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'exp')]"
-                                          },
-                                          "attributesNbf": {
-                                            "value": "[tryGet(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'attributes'), 'nbf')]"
-                                          },
-                                          "contentType": {
-                                            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'contentType')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('secrets'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "8701309639990049090"
-                                            },
-                                            "name": "Key Vault Secrets",
-                                            "description": "This module deploys a Key Vault Secret."
-                                          },
-                                          "definitions": {
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "keyVaultName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "minLength": 1,
-                                              "maxLength": 127,
-                                              "metadata": {
-                                                "description": "Required. The name of the secret (letters (upper and lower case), numbers, -)."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "metadata": {
-                                                "__bicep_resource_derived_type!": {
-                                                  "source": "Microsoft.KeyVault/vaults/secrets@2024-11-01#properties/tags"
-                                                },
-                                                "description": "Optional. Resource tags."
-                                              },
-                                              "nullable": true
-                                            },
-                                            "attributesEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Determines whether the object is enabled."
-                                              }
-                                            },
-                                            "attributesExp": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
-                                              }
-                                            },
-                                            "attributesNbf": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
-                                              }
-                                            },
-                                            "contentType": {
-                                              "type": "securestring",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The content type of the secret."
-                                              }
-                                            },
-                                            "value": {
-                                              "type": "securestring",
-                                              "metadata": {
-                                                "description": "Required. The value of the secret. NOTE: \"value\" will never be returned from the service, as APIs using this model are is intended for internal use in ARM deployments. Users should use the data-plane REST service for interaction with vault secrets."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
-                                              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
-                                              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
-                                              "Key Vault Secrets Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
-                                              "Key Vault Secrets User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.keyvault-secret.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "keyVault": {
-                                              "existing": true,
-                                              "type": "Microsoft.KeyVault/vaults",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[parameters('keyVaultName')]"
-                                            },
-                                            "secret": {
-                                              "type": "Microsoft.KeyVault/vaults/secrets",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "contentType": "[parameters('contentType')]",
-                                                "attributes": {
-                                                  "enabled": "[parameters('attributesEnabled')]",
-                                                  "exp": "[parameters('attributesExp')]",
-                                                  "nbf": "[parameters('attributesNbf')]"
-                                                },
-                                                "value": "[parameters('value')]"
-                                              }
-                                            },
-                                            "secret_roleAssignments": {
-                                              "copy": {
-                                                "name": "secret_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.KeyVault/vaults/{0}/secrets/{1}', parameters('keyVaultName'), parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "secret"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the secret."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the secret."
-                                              },
-                                              "value": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('name'))]"
-                                            },
-                                            "secretUri": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The uri of the secret."
-                                              },
-                                              "value": "[reference('secret').secretUri]"
-                                            },
-                                            "secretUriWithVersion": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The uri with version of the secret."
-                                              },
-                                              "value": "[reference('secret').secretUriWithVersion]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the secret was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    },
-                                    "keyVault_keys": {
-                                      "copy": {
-                                        "name": "keyVault_keys",
-                                        "count": "[length(coalesce(parameters('keys'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-KeyVault-Key-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(parameters('keys'), createArray())[copyIndex()].name]"
-                                          },
-                                          "keyVaultName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "attributesEnabled": {
-                                            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'enabled')]"
-                                          },
-                                          "attributesExp": {
-                                            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'exp')]"
-                                          },
-                                          "attributesNbf": {
-                                            "value": "[tryGet(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'attributes'), 'nbf')]"
-                                          },
-                                          "curveName": "[if(and(not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA')), not(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM'))), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'curveName'), 'P-256')), createObject('value', null()))]",
-                                          "keyOps": {
-                                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keyOps')]"
-                                          },
-                                          "keySize": "[if(or(equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA'), equals(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'RSA-HSM')), createObject('value', coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'keySize'), 4096)), createObject('value', null()))]",
-                                          "releasePolicy": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'releasePolicy'), createObject())]"
-                                          },
-                                          "kty": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'kty'), 'EC')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "rotationPolicy": {
-                                            "value": "[tryGet(coalesce(parameters('keys'), createArray())[copyIndex()], 'rotationPolicy')]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "1266219369073699726"
-                                            },
-                                            "name": "Key Vault Keys",
-                                            "description": "This module deploys a Key Vault Key."
-                                          },
-                                          "definitions": {
-                                            "rotationPolicyType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "attributes": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "expiryTime": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. The expiration time for the new key version. It should be in ISO8601 format. Eg: \"P90D\", \"P1Y\"."
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The attributes of key rotation policy."
-                                                  }
-                                                },
-                                                "lifetimeActions": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "action": {
-                                                        "type": "object",
-                                                        "properties": {
-                                                          "type": {
-                                                            "type": "string",
-                                                            "allowedValues": [
-                                                              "notify",
-                                                              "rotate"
-                                                            ],
-                                                            "nullable": true,
-                                                            "metadata": {
-                                                              "description": "Optional. The type of the action."
-                                                            }
-                                                          }
-                                                        },
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. The type of the action."
-                                                        }
-                                                      },
-                                                      "trigger": {
-                                                        "type": "object",
-                                                        "properties": {
-                                                          "timeAfterCreate": {
-                                                            "type": "string",
-                                                            "nullable": true,
-                                                            "metadata": {
-                                                              "description": "Optional. The time duration after key creation to rotate the key. It only applies to rotate. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
-                                                            }
-                                                          },
-                                                          "timeBeforeExpiry": {
-                                                            "type": "string",
-                                                            "nullable": true,
-                                                            "metadata": {
-                                                              "description": "Optional. The time duration before key expiring to rotate or notify. It will be in ISO 8601 duration format. Eg: \"P90D\", \"P1Y\"."
-                                                            }
-                                                          }
-                                                        },
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. The time duration for rotating the key."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The key rotation policy lifetime actions."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for a rotation policy."
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "keyVaultName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent key vault. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the key."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "metadata": {
-                                                "__bicep_resource_derived_type!": {
-                                                  "source": "Microsoft.KeyVault/vaults/keys@2024-11-01#properties/tags"
-                                                },
-                                                "description": "Optional. Resource tags."
-                                              },
-                                              "nullable": true
-                                            },
-                                            "attributesEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Determines whether the object is enabled."
-                                              }
-                                            },
-                                            "attributesExp": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Expiry date in seconds since 1970-01-01T00:00:00Z. For security reasons, it is recommended to set an expiration date whenever possible."
-                                              }
-                                            },
-                                            "attributesNbf": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Not before date in seconds since 1970-01-01T00:00:00Z."
-                                              }
-                                            },
-                                            "curveName": {
-                                              "type": "string",
-                                              "defaultValue": "P-256",
-                                              "allowedValues": [
-                                                "P-256",
-                                                "P-256K",
-                                                "P-384",
-                                                "P-521"
-                                              ],
-                                              "metadata": {
-                                                "description": "Optional. The elliptic curve name."
-                                              }
-                                            },
-                                            "keyOps": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "allowedValues": [
-                                                "decrypt",
-                                                "encrypt",
-                                                "import",
-                                                "sign",
-                                                "unwrapKey",
-                                                "verify",
-                                                "wrapKey"
-                                              ],
-                                              "metadata": {
-                                                "description": "Optional. Array of JsonWebKeyOperation."
-                                              }
-                                            },
-                                            "keySize": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The key size in bits. For example: 2048, 3072, or 4096 for RSA."
-                                              }
-                                            },
-                                            "kty": {
-                                              "type": "string",
-                                              "defaultValue": "EC",
-                                              "allowedValues": [
-                                                "EC",
-                                                "EC-HSM",
-                                                "RSA",
-                                                "RSA-HSM"
-                                              ],
-                                              "metadata": {
-                                                "description": "Optional. The type of the key."
-                                              }
-                                            },
-                                            "releasePolicy": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Key release policy."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "rotationPolicy": {
-                                              "$ref": "#/definitions/rotationPolicyType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Key rotation policy properties object."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "Key Vault Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '00482a5a-887f-4fb3-b363-3b7fe8e74483')]",
-                                              "Key Vault Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f25e0fa2-a7c8-4377-a976-54943a77a395')]",
-                                              "Key Vault Crypto Officer": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '14b46e9e-c2b7-41b4-b07b-48a6ebf60603')]",
-                                              "Key Vault Crypto Service Encryption User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]",
-                                              "Key Vault Crypto User": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '12338af0-0e69-4776-bea7-57ae8d297424')]",
-                                              "Key Vault Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '21090545-7ca7-4776-b22c-e363652d74d2')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                              "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.keyvault-key.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "keyVault": {
-                                              "existing": true,
-                                              "type": "Microsoft.KeyVault/vaults",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[parameters('keyVaultName')]"
-                                            },
-                                            "key": {
-                                              "type": "Microsoft.KeyVault/vaults/keys",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('name'))]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": "[shallowMerge(createArray(createObject('attributes', createObject('enabled', parameters('attributesEnabled'), 'exp', parameters('attributesExp'), 'nbf', parameters('attributesNbf')), 'curveName', parameters('curveName'), 'keyOps', parameters('keyOps'), 'keySize', parameters('keySize'), 'kty', parameters('kty'), 'release_policy', coalesce(parameters('releasePolicy'), createObject())), if(not(empty(parameters('rotationPolicy'))), createObject('rotationPolicy', parameters('rotationPolicy')), createObject())))]"
-                                            },
-                                            "key_roleAssignments": {
-                                              "copy": {
-                                                "name": "key_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.KeyVault/vaults/{0}/keys/{1}', parameters('keyVaultName'), parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "key"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "keyUri": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The uri of the key."
-                                              },
-                                              "value": "[reference('key').keyUri]"
-                                            },
-                                            "keyUriWithVersion": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The uri with version of the key."
-                                              },
-                                              "value": "[reference('key').keyUriWithVersion]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the key."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the key."
-                                              },
-                                              "value": "[resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the key was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    },
-                                    "keyVault_privateEndpoints": {
-                                      "copy": {
-                                        "name": "keyVault_privateEndpoints",
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-keyVault-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex()))]"
-                                          },
-                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')))))), createObject('value', null()))]",
-                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.KeyVault/vaults', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.KeyVault/vaults', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'vault')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                                          "subnetResourceId": {
-                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          },
-                                          "location": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                                          },
-                                          "lock": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                                          },
-                                          "privateDnsZoneGroup": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "customDnsConfigs": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                                          },
-                                          "ipConfigurations": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                                          },
-                                          "applicationSecurityGroupResourceIds": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                                          },
-                                          "customNetworkInterfaceName": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.34.44.8038",
-                                              "templateHash": "12389807800450456797"
-                                            },
-                                            "name": "Private Endpoints",
-                                            "description": "This module deploys a Private Endpoint."
-                                          },
-                                          "definitions": {
-                                            "privateDnsZoneGroupType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                                  }
-                                                },
-                                                "privateDnsZoneGroupConfigs": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "ipConfigurationType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "memberName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "privateIPAddress": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private endpoint IP configurations."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "privateLinkServiceConnectionType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the private link service connection."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupIds": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                                      }
-                                                    },
-                                                    "privateLinkServiceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The resource id of private link service."
-                                                      }
-                                                    },
-                                                    "requestMessage": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private link service connection."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "customDnsConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "fqdn": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                                  }
-                                                },
-                                                "ipAddresses": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "lockType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the name of lock."
-                                                  }
-                                                },
-                                                "kind": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "CanNotDelete",
-                                                    "None",
-                                                    "ReadOnly"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the type of lock."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a lock.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            },
-                                            "privateDnsZoneGroupConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the private DNS zone group config."
-                                                  }
-                                                },
-                                                "privateDnsZoneResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The resource id of the private DNS zone."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                                }
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the private endpoint resource to create."
-                                              }
-                                            },
-                                            "subnetResourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                              }
-                                            },
-                                            "applicationSecurityGroupResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                              }
-                                            },
-                                            "customNetworkInterfaceName": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                              }
-                                            },
-                                            "ipConfigurations": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/ipConfigurationType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                              }
-                                            },
-                                            "privateDnsZoneGroup": {
-                                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                              }
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "defaultValue": "[resourceGroup().location]",
-                                              "metadata": {
-                                                "description": "Optional. Location for all Resources."
-                                              }
-                                            },
-                                            "lock": {
-                                              "$ref": "#/definitions/lockType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The lock settings of the service."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                              }
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Custom DNS configurations."
-                                              }
-                                            },
-                                            "manualPrivateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "privateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint": {
-                                              "type": "Microsoft.Network/privateEndpoints",
-                                              "apiVersion": "2024-05-01",
-                                              "name": "[parameters('name')]",
-                                              "location": "[parameters('location')]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "applicationSecurityGroups",
-                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                                    "input": {
-                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                                    }
-                                                  }
-                                                ],
-                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                                "subnet": {
-                                                  "id": "[parameters('subnetResourceId')]"
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint_lock": {
-                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                              "type": "Microsoft.Authorization/locks",
-                                              "apiVersion": "2020-05-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                              "properties": {
-                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_roleAssignments": {
-                                              "copy": {
-                                                "name": "privateEndpoint_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_privateDnsZoneGroup": {
-                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                                  },
-                                                  "privateEndpointName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "privateDnsZoneConfigs": {
-                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.34.44.8038",
-                                                      "templateHash": "13997305779829540948"
-                                                    },
-                                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                                  },
-                                                  "definitions": {
-                                                    "privateDnsZoneGroupConfigType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name of the private DNS zone group config."
-                                                          }
-                                                        },
-                                                        "privateDnsZoneResourceId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The resource id of the private DNS zone."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "__bicep_export!": true
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "privateEndpointName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "privateDnsZoneConfigs": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                      },
-                                                      "minLength": 1,
-                                                      "maxLength": 5,
-                                                      "metadata": {
-                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Optional. The name of the private DNS zone group."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "privateDnsZoneConfigsVar",
-                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                                        "input": {
-                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                                          "properties": {
-                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                                          }
-                                                        }
-                                                      }
-                                                    ]
-                                                  },
-                                                  "resources": {
-                                                    "privateEndpoint": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Network/privateEndpoints",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[parameters('privateEndpointName')]"
-                                                    },
-                                                    "privateDnsZoneGroup": {
-                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group the private endpoint was deployed into."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the private endpoint."
-                                              },
-                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the private endpoint."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The location the resource was deployed into."
-                                              },
-                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "metadata": {
-                                                "description": "The custom DNS configurations of the private endpoint."
-                                              },
-                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                                            },
-                                            "networkInterfaceResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "metadata": {
-                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                                              },
-                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                                            },
-                                            "groupId": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "The group Id for the private endpoint Group."
-                                              },
-                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "keyVault"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the key vault."
-                                      },
-                                      "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the key vault was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the key vault."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "uri": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The URI of the key vault."
-                                      },
-                                      "value": "[reference('keyVault').vaultUri]"
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The location the resource was deployed into."
-                                      },
-                                      "value": "[reference('keyVault', '2024-11-01', 'full').location]"
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The private endpoints of the key vault."
-                                      },
-                                      "copy": {
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                                        "input": {
-                                          "name": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                                          "resourceId": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                                          "groupId": "[tryGet(tryGet(reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                                          "customDnsConfigs": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                                          "networkInterfaceResourceIds": "[reference(format('keyVault_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                                        }
-                                      }
-                                    },
-                                    "secrets": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/credentialOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The properties of the created secrets."
-                                      },
-                                      "copy": {
-                                        "count": "[length(range(0, length(coalesce(parameters('secrets'), createArray()))))]",
-                                        "input": {
-                                          "resourceId": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.resourceId.value]",
-                                          "uri": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUri.value]",
-                                          "uriWithVersion": "[reference(format('keyVault_secrets[{0}]', range(0, length(coalesce(parameters('secrets'), createArray())))[copyIndex()])).outputs.secretUriWithVersion.value]"
-                                        }
-                                      }
-                                    },
-                                    "keys": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/credentialOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The properties of the created keys."
-                                      },
-                                      "copy": {
-                                        "count": "[length(range(0, length(coalesce(parameters('keys'), createArray()))))]",
-                                        "input": {
-                                          "resourceId": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.resourceId.value]",
-                                          "uri": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUri.value]",
-                                          "uriWithVersion": "[reference(format('keyVault_keys[{0}]', range(0, length(coalesce(parameters('keys'), createArray())))[copyIndex()])).outputs.keyUriWithVersion.value]"
-                                        }
-                                      }
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the Key Vault."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.name.value, variables('existingName'))]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource ID of the Key Vault."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('keyVault').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.KeyVault/vaults', variables('existingName')))]"
-                            },
-                            "subscriptionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Subscription ID of the Key Vault."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource Group Name of the Key Vault."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "aiSearch": {
-                      "condition": "[parameters('includeAssociatedResources')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('module.aiSearch.{0}', variables('resourcesName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "existingResourceId": {
-                            "value": "[tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')]"
-                          },
-                          "name": {
-                            "value": "[take(if(not(empty(tryGet(parameters('aiSearchConfiguration'), 'name'))), parameters('aiSearchConfiguration').name, format('srch{0}', variables('resourcesName'))), 60)]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[parameters('enableTelemetry')]"
-                          },
-                          "privateEndpointSubnetResourceId": {
-                            "value": "[parameters('privateEndpointSubnetResourceId')]"
-                          },
-                          "privateDnsZoneResourceId": {
-                            "value": "[tryGet(parameters('aiSearchConfiguration'), 'privateDnsZoneResourceId')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(parameters('aiSearchConfiguration'), 'roleAssignments')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "2804046174313565921"
-                            }
-                          },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "functions": [
-                            {
-                              "namespace": "__bicep",
-                              "members": {
-                                "getResourceGroupName": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Group Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceName": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    },
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceParts": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
-                                  },
-                                  "metadata": {
-                                    "description": "Splits Resource ID into its components.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getSubscriptionId": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Subscription ID from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          ],
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "maxLength": 60,
-                              "metadata": {
-                                "description": "Required. The name of the AI Search resource."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The location for the AI Search resource."
-                              }
-                            },
-                            "existingResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The full resource ID of an existing AI Search resource to use instead of creating a new one."
-                              }
-                            },
-                            "privateEndpointSubnetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints."
-                              }
-                            },
-                            "privateDnsZoneResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the private DNS zone for the AI Search resource to establish private endpoints."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Specifies the role assignments for the AI Search resource."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                                },
-                                "description": "Optional. Specifies the resource tags for all the resources."
-                              },
-                              "defaultValue": {}
-                            }
-                          },
-                          "variables": {
-                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
-                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
-                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
-                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
-                            "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
-                          },
-                          "resources": {
-                            "existingSearchService": {
-                              "condition": "[not(empty(parameters('existingResourceId')))]",
-                              "existing": true,
-                              "type": "Microsoft.Search/searchServices",
-                              "apiVersion": "2025-05-01",
-                              "subscriptionId": "[variables('existingSubscriptionId')]",
-                              "resourceGroup": "[variables('existingResourceGroupName')]",
-                              "name": "[variables('existingName')]"
-                            },
-                            "aiSearch": {
-                              "condition": "[empty(parameters('existingResourceId'))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('avm.res.search.search-service.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[parameters('enableTelemetry')]"
-                                  },
-                                  "cmkEnforcement": {
-                                    "value": "Unspecified"
-                                  },
-                                  "managedIdentities": {
-                                    "value": {
-                                      "systemAssigned": true
-                                    }
-                                  },
-                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-                                  "disableLocalAuth": {
-                                    "value": "[variables('privateNetworkingEnabled')]"
-                                  },
-                                  "authOptions": "[if(variables('privateNetworkingEnabled'), createObject('value', null()), createObject('value', createObject('aadOrApiKey', createObject('aadAuthFailureMode', 'http401WithBearerChallenge'))))]",
-                                  "sku": {
-                                    "value": "standard"
-                                  },
-                                  "partitionCount": {
-                                    "value": 1
-                                  },
-                                  "replicaCount": {
-                                    "value": 3
-                                  },
-                                  "roleAssignments": {
-                                    "value": "[parameters('roleAssignments')]"
-                                  },
-                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
-                                  "tags": {
-                                    "value": "[parameters('tags')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "10902281417196168235"
-                                    },
-                                    "name": "Search Services",
-                                    "description": "This module deploys a Search Service."
-                                  },
-                                  "definitions": {
-                                    "privateEndpointOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The name of the private endpoint."
-                                          }
-                                        },
-                                        "resourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resource ID of the private endpoint."
-                                          }
-                                        },
-                                        "groupId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "The group Id for the private endpoint Group."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "fqdn": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "FQDN that resolves to private endpoint IP address."
-                                                }
-                                              },
-                                              "ipAddresses": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "string"
-                                                },
-                                                "metadata": {
-                                                  "description": "A list of private IP addresses of the private endpoint."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "The custom DNS configurations of the private endpoint."
-                                          }
-                                        },
-                                        "networkInterfaceResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    },
-                                    "secretsExportConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "keyVaultResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The key vault name where to store the API Admin keys generated by the modules."
-                                          }
-                                        },
-                                        "primaryAdminKeyName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The primaryAdminKey secret name to create."
-                                          }
-                                        },
-                                        "secondaryAdminKeyName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The secondaryAdminKey secret name to create."
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "secretsOutputType": {
-                                      "type": "object",
-                                      "properties": {},
-                                      "additionalProperties": {
-                                        "$ref": "#/definitions/secretSetType",
-                                        "metadata": {
-                                          "description": "An exported secret's references."
-                                        }
-                                      }
-                                    },
-                                    "authOptionsType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "aadOrApiKey": {
-                                          "type": "object",
-                                          "properties": {
-                                            "aadAuthFailureMode": {
-                                              "type": "string",
-                                              "allowedValues": [
-                                                "http401WithBearerChallenge",
-                                                "http403"
-                                              ],
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Describes what response the data plane API of a search service would send for requests that failed authentication."
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Indicates that either the API key or an access token from a Microsoft Entra ID tenant can be used for authentication."
-                                          }
-                                        },
-                                        "apiKeyOnly": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Indicates that only the API key can be used for authentication."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    },
-                                    "networkRuleSetType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "bypass": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzurePortal",
-                                            "AzureServices",
-                                            "None"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Network specific rules that determine how the Azure AI Search service may be reached."
-                                          }
-                                        },
-                                        "ipRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/ipRuleType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP restriction rules that defines the inbound network(s) with allowing access to the search service endpoint. At the meantime, all other public IP networks are blocked by the firewall. These restriction rules are applied only when the 'publicNetworkAccess' of the search service is 'enabled'; otherwise, traffic over public interface is not allowed even with any public IP rules, and private endpoint connections would be the exclusive access method."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    },
-                                    "ipRuleType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "value": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Value corresponding to a single IPv4 address (eg., 123.1.2.3) or an IP range in CIDR format (eg., 123.1.2.3/24) to be allowed."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true
-                                      }
-                                    },
-                                    "_1.lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointCustomDnsConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "fqdn": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                          }
-                                        },
-                                        "ipAddresses": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of private IP addresses of the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointIpConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the resource that is unique within a resource group."
-                                          }
-                                        },
-                                        "properties": {
-                                          "type": "object",
-                                          "properties": {
-                                            "groupId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "memberName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "privateIPAddress": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Properties of private endpoint IP configurations."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private DNS Zone Group."
-                                          }
-                                        },
-                                        "privateDnsZoneGroupConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "name": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                                }
-                                              },
-                                              "privateDnsZoneResourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource id of the private DNS zone."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "diagnosticSettingFullType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the diagnostic setting."
-                                          }
-                                        },
-                                        "logCategoriesAndGroups": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                }
-                                              },
-                                              "categoryGroup": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                          }
-                                        },
-                                        "metricCategories": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                          }
-                                        },
-                                        "logAnalyticsDestinationType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureDiagnostics",
-                                            "Dedicated"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                          }
-                                        },
-                                        "workspaceResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "storageAccountResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "eventHubAuthorizationRuleResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                          }
-                                        },
-                                        "eventHubName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "marketplacePartnerResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                        }
-                                      }
-                                    },
-                                    "lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "managedIdentityAllType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "systemAssigned": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enables system assigned managed identity on the resource."
-                                          }
-                                        },
-                                        "userAssignedResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                        }
-                                      }
-                                    },
-                                    "privateEndpointSingleServiceType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private Endpoint."
-                                          }
-                                        },
-                                        "location": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The location to deploy the Private Endpoint to."
-                                          }
-                                        },
-                                        "privateLinkServiceConnectionName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private link connection to create."
-                                          }
-                                        },
-                                        "service": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The subresource to deploy the Private Endpoint for. For example \"vault\" for a Key Vault Private Endpoint."
-                                          }
-                                        },
-                                        "subnetResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                          }
-                                        },
-                                        "resourceGroupResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                                          }
-                                        },
-                                        "privateDnsZoneGroup": {
-                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The private DNS Zone Group to configure for the Private Endpoint."
-                                          }
-                                        },
-                                        "isManualConnection": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. If Manual Private Link Connection is required."
-                                          }
-                                        },
-                                        "manualConnectionRequestMessage": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "maxLength": 140,
-                                          "metadata": {
-                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Custom DNS configurations."
-                                          }
-                                        },
-                                        "ipConfigurations": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP configurations of the Private Endpoint. This will be used to map to the first-party Service endpoints."
-                                          }
-                                        },
-                                        "applicationSecurityGroupResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Application security groups in which the Private Endpoint IP configuration is included."
-                                          }
-                                        },
-                                        "customNetworkInterfaceName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The custom name of the network interface attached to the Private Endpoint."
-                                          }
-                                        },
-                                        "lock": {
-                                          "$ref": "#/definitions/_1.lockType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "__bicep_resource_derived_type!": {
-                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                                            },
-                                            "description": "Optional. Tags to be applied on all resources/Resource Groups in this deployment."
-                                          }
-                                        },
-                                        "enableTelemetry": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable/Disable usage telemetry for module."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can be assumed (i.e., for services that only have one Private Endpoint type like 'vault' for key vault).",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                        }
-                                      }
-                                    },
-                                    "secretSetType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "secretResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resourceId of the exported secret."
-                                          }
-                                        },
-                                        "secretUri": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The secret URI of the exported secret."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "modules/keyVaultExport.bicep"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the Azure Cognitive Search service to create or update. Search service names must only contain lowercase letters, digits or dashes, cannot use dash as the first two or last one characters, cannot contain consecutive dashes, and must be between 2 and 60 characters in length. Search service names must be globally unique since they are part of the service URI (https://<name>.search.windows.net). You cannot change the service name after the service is created."
-                                      }
-                                    },
-                                    "authOptions": {
-                                      "$ref": "#/definitions/authOptionsType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Defines the options for how the data plane API of a Search service authenticates requests. Must remain an empty object {} if 'disableLocalAuth' is set to true."
-                                      }
-                                    },
-                                    "disableLocalAuth": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. When set to true, calls to the search service will not be permitted to utilize API keys for authentication. This cannot be set to true if 'authOptions' are defined."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    },
-                                    "cmkEnforcement": {
-                                      "type": "string",
-                                      "defaultValue": "Unspecified",
-                                      "allowedValues": [
-                                        "Disabled",
-                                        "Enabled",
-                                        "Unspecified"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Describes a policy that determines how resources within the search service are to be encrypted with Customer Managed Keys."
-                                      }
-                                    },
-                                    "hostingMode": {
-                                      "type": "string",
-                                      "defaultValue": "default",
-                                      "allowedValues": [
-                                        "default",
-                                        "highDensity"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Applicable only for the standard3 SKU. You can set this property to enable up to 3 high density partitions that allow up to 1000 indexes, which is much higher than the maximum indexes allowed for any other SKU. For the standard3 SKU, the value is either 'default' or 'highDensity'. For all other SKUs, this value must be 'default'."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "defaultValue": "[resourceGroup().location]",
-                                      "metadata": {
-                                        "description": "Optional. Location for all Resources."
-                                      }
-                                    },
-                                    "lock": {
-                                      "$ref": "#/definitions/lockType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The lock settings for all Resources in the solution."
-                                      }
-                                    },
-                                    "networkRuleSet": {
-                                      "$ref": "#/definitions/networkRuleSetType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Network specific rules that determine how the Azure Cognitive Search service may be reached."
-                                      }
-                                    },
-                                    "partitionCount": {
-                                      "type": "int",
-                                      "defaultValue": 1,
-                                      "minValue": 1,
-                                      "maxValue": 12,
-                                      "metadata": {
-                                        "description": "Optional. The number of partitions in the search service; if specified, it can be 1, 2, 3, 4, 6, or 12. Values greater than 1 are only valid for standard SKUs. For 'standard3' services with hostingMode set to 'highDensity', the allowed values are between 1 and 3."
-                                      }
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointSingleServiceType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                                      }
-                                    },
-                                    "sharedPrivateLinkResources": {
-                                      "type": "array",
-                                      "defaultValue": [],
-                                      "metadata": {
-                                        "description": "Optional. The sharedPrivateLinkResources to create as part of the search Service."
-                                      }
-                                    },
-                                    "publicNetworkAccess": {
-                                      "type": "string",
-                                      "defaultValue": "Enabled",
-                                      "allowedValues": [
-                                        "Enabled",
-                                        "Disabled"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. This value can be set to 'Enabled' to avoid breaking changes on existing customer resources and templates. If set to 'Disabled', traffic over public interface is not allowed, and private endpoint connections would be the exclusive access method."
-                                      }
-                                    },
-                                    "secretsExportConfiguration": {
-                                      "$ref": "#/definitions/secretsExportConfigurationType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
-                                      }
-                                    },
-                                    "replicaCount": {
-                                      "type": "int",
-                                      "defaultValue": 3,
-                                      "minValue": 1,
-                                      "maxValue": 12,
-                                      "metadata": {
-                                        "description": "Optional. The number of replicas in the search service. If specified, it must be a value between 1 and 12 inclusive for standard SKUs or between 1 and 3 inclusive for basic SKU."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    },
-                                    "semanticSearch": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "disabled",
-                                        "free",
-                                        "standard"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Sets options that control the availability of semantic search. This configuration is only possible for certain search SKUs in certain locations."
-                                      }
-                                    },
-                                    "sku": {
-                                      "type": "string",
-                                      "defaultValue": "standard",
-                                      "allowedValues": [
-                                        "basic",
-                                        "free",
-                                        "standard",
-                                        "standard2",
-                                        "standard3",
-                                        "storage_optimized_l1",
-                                        "storage_optimized_l2"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Defines the SKU of an Azure Cognitive Search Service, which determines price tier and capacity limits."
-                                      }
-                                    },
-                                    "managedIdentities": {
-                                      "$ref": "#/definitions/managedIdentityAllType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The managed identity definition for this resource."
-                                      }
-                                    },
-                                    "diagnosticSettings": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/diagnosticSettingFullType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The diagnostic settings of the service."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.Search/searchServices@2025-02-01-preview#properties/tags"
-                                        },
-                                        "description": "Optional. Tags to help categorize the resource in the Azure portal."
-                                      },
-                                      "nullable": true
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "enableReferencedModulesTelemetry": false,
-                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', '')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Search Index Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
-                                      "Search Index Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]",
-                                      "Search Service Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.search-searchservice.{0}.{1}', replace('0.11.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "searchService": {
-                                      "type": "Microsoft.Search/searchServices",
-                                      "apiVersion": "2025-02-01-preview",
-                                      "name": "[parameters('name')]",
-                                      "location": "[parameters('location')]",
-                                      "sku": {
-                                        "name": "[parameters('sku')]"
-                                      },
-                                      "tags": "[parameters('tags')]",
-                                      "identity": "[variables('identity')]",
-                                      "properties": {
-                                        "authOptions": "[parameters('authOptions')]",
-                                        "disableLocalAuth": "[parameters('disableLocalAuth')]",
-                                        "encryptionWithCmk": {
-                                          "enforcement": "[parameters('cmkEnforcement')]"
-                                        },
-                                        "hostingMode": "[parameters('hostingMode')]",
-                                        "networkRuleSet": "[parameters('networkRuleSet')]",
-                                        "partitionCount": "[parameters('partitionCount')]",
-                                        "replicaCount": "[parameters('replicaCount')]",
-                                        "publicNetworkAccess": "[toLower(parameters('publicNetworkAccess'))]",
-                                        "semanticSearch": "[parameters('semanticSearch')]"
-                                      }
-                                    },
-                                    "searchService_diagnosticSettings": {
-                                      "copy": {
-                                        "name": "searchService_diagnosticSettings",
-                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Insights/diagnosticSettings",
-                                      "apiVersion": "2021-05-01-preview",
-                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                                      "properties": {
-                                        "copy": [
-                                          {
-                                            "name": "metrics",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                            "input": {
-                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                              "timeGrain": null
-                                            }
-                                          },
-                                          {
-                                            "name": "logs",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                            "input": {
-                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                            }
-                                          }
-                                        ],
-                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                      },
-                                      "dependsOn": [
-                                        "searchService"
-                                      ]
-                                    },
-                                    "searchService_lock": {
-                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                      "type": "Microsoft.Authorization/locks",
-                                      "apiVersion": "2020-05-01",
-                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                      "properties": {
-                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                                      },
-                                      "dependsOn": [
-                                        "searchService"
-                                      ]
-                                    },
-                                    "searchService_roleAssignments": {
-                                      "copy": {
-                                        "name": "searchService_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Search/searchServices', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "searchService"
-                                      ]
-                                    },
-                                    "searchService_privateEndpoints": {
-                                      "copy": {
-                                        "name": "searchService_privateEndpoints",
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-searchService-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex()))]"
-                                          },
-                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')))))), createObject('value', null()))]",
-                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService'), copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Search/searchServices', parameters('name')), 'groupIds', createArray(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'service'), 'searchService')), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                                          "subnetResourceId": {
-                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          },
-                                          "location": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                                          },
-                                          "lock": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                                          },
-                                          "privateDnsZoneGroup": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "customDnsConfigs": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                                          },
-                                          "ipConfigurations": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                                          },
-                                          "applicationSecurityGroupResourceIds": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                                          },
-                                          "customNetworkInterfaceName": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.34.44.8038",
-                                              "templateHash": "12389807800450456797"
-                                            },
-                                            "name": "Private Endpoints",
-                                            "description": "This module deploys a Private Endpoint."
-                                          },
-                                          "definitions": {
-                                            "privateDnsZoneGroupType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                                  }
-                                                },
-                                                "privateDnsZoneGroupConfigs": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "ipConfigurationType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "memberName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "privateIPAddress": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private endpoint IP configurations."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "privateLinkServiceConnectionType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the private link service connection."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupIds": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                                      }
-                                                    },
-                                                    "privateLinkServiceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The resource id of private link service."
-                                                      }
-                                                    },
-                                                    "requestMessage": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private link service connection."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "customDnsConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "fqdn": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                                  }
-                                                },
-                                                "ipAddresses": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "lockType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the name of lock."
-                                                  }
-                                                },
-                                                "kind": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "CanNotDelete",
-                                                    "None",
-                                                    "ReadOnly"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the type of lock."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a lock.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            },
-                                            "privateDnsZoneGroupConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the private DNS zone group config."
-                                                  }
-                                                },
-                                                "privateDnsZoneResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The resource id of the private DNS zone."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                                }
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the private endpoint resource to create."
-                                              }
-                                            },
-                                            "subnetResourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                              }
-                                            },
-                                            "applicationSecurityGroupResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                              }
-                                            },
-                                            "customNetworkInterfaceName": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                              }
-                                            },
-                                            "ipConfigurations": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/ipConfigurationType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                              }
-                                            },
-                                            "privateDnsZoneGroup": {
-                                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                              }
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "defaultValue": "[resourceGroup().location]",
-                                              "metadata": {
-                                                "description": "Optional. Location for all Resources."
-                                              }
-                                            },
-                                            "lock": {
-                                              "$ref": "#/definitions/lockType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The lock settings of the service."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                              }
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Custom DNS configurations."
-                                              }
-                                            },
-                                            "manualPrivateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "privateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint": {
-                                              "type": "Microsoft.Network/privateEndpoints",
-                                              "apiVersion": "2024-05-01",
-                                              "name": "[parameters('name')]",
-                                              "location": "[parameters('location')]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "applicationSecurityGroups",
-                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                                    "input": {
-                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                                    }
-                                                  }
-                                                ],
-                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                                "subnet": {
-                                                  "id": "[parameters('subnetResourceId')]"
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint_lock": {
-                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                              "type": "Microsoft.Authorization/locks",
-                                              "apiVersion": "2020-05-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                              "properties": {
-                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_roleAssignments": {
-                                              "copy": {
-                                                "name": "privateEndpoint_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_privateDnsZoneGroup": {
-                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                                  },
-                                                  "privateEndpointName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "privateDnsZoneConfigs": {
-                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.34.44.8038",
-                                                      "templateHash": "13997305779829540948"
-                                                    },
-                                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                                  },
-                                                  "definitions": {
-                                                    "privateDnsZoneGroupConfigType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name of the private DNS zone group config."
-                                                          }
-                                                        },
-                                                        "privateDnsZoneResourceId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The resource id of the private DNS zone."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "__bicep_export!": true
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "privateEndpointName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "privateDnsZoneConfigs": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                      },
-                                                      "minLength": 1,
-                                                      "maxLength": 5,
-                                                      "metadata": {
-                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Optional. The name of the private DNS zone group."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "privateDnsZoneConfigsVar",
-                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                                        "input": {
-                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                                          "properties": {
-                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                                          }
-                                                        }
-                                                      }
-                                                    ]
-                                                  },
-                                                  "resources": {
-                                                    "privateEndpoint": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Network/privateEndpoints",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[parameters('privateEndpointName')]"
-                                                    },
-                                                    "privateDnsZoneGroup": {
-                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group the private endpoint was deployed into."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the private endpoint."
-                                              },
-                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the private endpoint."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The location the resource was deployed into."
-                                              },
-                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "metadata": {
-                                                "description": "The custom DNS configurations of the private endpoint."
-                                              },
-                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                                            },
-                                            "networkInterfaceResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "metadata": {
-                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                                              },
-                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                                            },
-                                            "groupId": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "The group Id for the private endpoint Group."
-                                              },
-                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "searchService"
-                                      ]
-                                    },
-                                    "searchService_sharedPrivateLinkResources": {
-                                      "copy": {
-                                        "name": "searchService_sharedPrivateLinkResources",
-                                        "count": "[length(parameters('sharedPrivateLinkResources'))]",
-                                        "mode": "serial",
-                                        "batchSize": 1
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-searchService-SharedPrvLink-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'name'), format('spl-{0}-{1}-{2}', last(split(resourceId('Microsoft.Search/searchServices', parameters('name')), '/')), parameters('sharedPrivateLinkResources')[copyIndex()].groupId, copyIndex()))]"
-                                          },
-                                          "searchServiceName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "privateLinkResourceId": {
-                                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].privateLinkResourceId]"
-                                          },
-                                          "groupId": {
-                                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].groupId]"
-                                          },
-                                          "requestMessage": {
-                                            "value": "[parameters('sharedPrivateLinkResources')[copyIndex()].requestMessage]"
-                                          },
-                                          "resourceRegion": {
-                                            "value": "[tryGet(parameters('sharedPrivateLinkResources')[copyIndex()], 'resourceRegion')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "557730297583881254"
-                                            },
-                                            "name": "Search Services Private Link Resources",
-                                            "description": "This module deploys a Search Service Private Link Resource."
-                                          },
-                                          "parameters": {
-                                            "searchServiceName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent searchServices. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the shared private link resource managed by the Azure Cognitive Search service within the specified resource group."
-                                              }
-                                            },
-                                            "privateLinkResourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The resource ID of the resource the shared private link resource is for."
-                                              }
-                                            },
-                                            "groupId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The group ID from the provider of resource the shared private link resource is for."
-                                              }
-                                            },
-                                            "requestMessage": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The request message for requesting approval of the shared private link resource."
-                                              }
-                                            },
-                                            "resourceRegion": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Can be used to specify the Azure Resource Manager location of the resource to which a shared private link is to be created. This is only required for those resources whose DNS configuration are regional (such as Azure Kubernetes Service)."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "searchService": {
-                                              "existing": true,
-                                              "type": "Microsoft.Search/searchServices",
-                                              "apiVersion": "2025-02-01-preview",
-                                              "name": "[parameters('searchServiceName')]"
-                                            },
-                                            "sharedPrivateLinkResource": {
-                                              "type": "Microsoft.Search/searchServices/sharedPrivateLinkResources",
-                                              "apiVersion": "2025-02-01-preview",
-                                              "name": "[format('{0}/{1}', parameters('searchServiceName'), parameters('name'))]",
-                                              "properties": {
-                                                "privateLinkResourceId": "[parameters('privateLinkResourceId')]",
-                                                "groupId": "[parameters('groupId')]",
-                                                "requestMessage": "[parameters('requestMessage')]",
-                                                "resourceRegion": "[parameters('resourceRegion')]"
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the shared private link resource."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the shared private link resource."
-                                              },
-                                              "value": "[resourceId('Microsoft.Search/searchServices/sharedPrivateLinkResources', parameters('searchServiceName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the shared private link resource was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "searchService"
-                                      ]
-                                    },
-                                    "secretsExport": {
-                                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
-                                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "keyVaultName": {
-                                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
-                                          },
-                                          "secretsToSet": {
-                                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'primaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').primaryKey)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'secondaryAdminKeyName'), 'value', listAdminKeys('searchService', '2025-02-01-preview').secondaryKey)), createArray()))]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "7634110751636246703"
-                                            }
-                                          },
-                                          "definitions": {
-                                            "secretSetType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "secretResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The resourceId of the exported secret."
-                                                  }
-                                                },
-                                                "secretUri": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The secret URI of the exported secret."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "secretToSetType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the secret to set."
-                                                  }
-                                                },
-                                                "value": {
-                                                  "type": "securestring",
-                                                  "metadata": {
-                                                    "description": "Required. The value of the secret to set."
-                                                  }
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "keyVaultName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the Key Vault to set the ecrets in."
-                                              }
-                                            },
-                                            "secretsToSet": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/secretToSetType"
-                                              },
-                                              "metadata": {
-                                                "description": "Required. The secrets to set in the Key Vault."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "keyVault": {
-                                              "existing": true,
-                                              "type": "Microsoft.KeyVault/vaults",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[parameters('keyVaultName')]"
-                                            },
-                                            "secrets": {
-                                              "copy": {
-                                                "name": "secrets",
-                                                "count": "[length(parameters('secretsToSet'))]"
-                                              },
-                                              "type": "Microsoft.KeyVault/vaults/secrets",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
-                                              "properties": {
-                                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "secretsSet": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/secretSetType"
-                                              },
-                                              "metadata": {
-                                                "description": "The references to the secrets exported to the provided Key Vault."
-                                              },
-                                              "copy": {
-                                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
-                                                "input": {
-                                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
-                                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]"
-                                                }
-                                              }
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "searchService"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the search service."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the search service."
-                                      },
-                                      "value": "[resourceId('Microsoft.Search/searchServices', parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the search service was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    },
-                                    "systemAssignedMIPrincipalId": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "The principal ID of the system assigned identity."
-                                      },
-                                      "value": "[tryGet(tryGet(reference('searchService', '2025-02-01-preview', 'full'), 'identity'), 'principalId')]"
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The location the resource was deployed into."
-                                      },
-                                      "value": "[reference('searchService', '2025-02-01-preview', 'full').location]"
-                                    },
-                                    "endpoint": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The endpoint of the search service."
-                                      },
-                                      "value": "[reference('searchService').endpoint]"
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The private endpoints of the search service."
-                                      },
-                                      "copy": {
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                                        "input": {
-                                          "name": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                                          "resourceId": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                                          "groupId": "[tryGet(tryGet(reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                                          "customDnsConfigs": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                                          "networkInterfaceResourceIds": "[reference(format('searchService_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                                        }
-                                      }
-                                    },
-                                    "exportedSecrets": {
-                                      "$ref": "#/definitions/secretsOutputType",
-                                      "metadata": {
-                                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
-                                      },
-                                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
-                                    },
-                                    "primaryKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary admin API key of the search service."
-                                      },
-                                      "value": "[listAdminKeys('searchService', '2025-02-01-preview').primaryKey]"
-                                    },
-                                    "secondaryKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondaryKey admin API key of the search service."
-                                      },
-                                      "value": "[listAdminKeys('searchService', '2025-02-01-preview').secondaryKey]"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the AI Search resource."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.name.value, variables('existingName'))]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource ID of the AI Search resource."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Search/searchServices', variables('existingName')))]"
-                            },
-                            "subscriptionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Subscription ID of the AI Search resource."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource Group Name of the AI Search resource."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
-                            },
-                            "systemAssignedMIPrincipalId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "System assigned managed identity principal ID of the AI Search resource."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, '')]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "storageAccount": {
-                      "condition": "[parameters('includeAssociatedResources')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('module.storageAccount.{0}', variables('resourcesName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "existingResourceId": {
-                            "value": "[tryGet(parameters('storageAccountConfiguration'), 'existingResourceId')]"
-                          },
-                          "name": {
-                            "value": "[take(if(not(empty(tryGet(parameters('storageAccountConfiguration'), 'name'))), parameters('storageAccountConfiguration').name, format('st{0}', variables('resourcesName'))), 24)]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[parameters('enableTelemetry')]"
-                          },
-                          "privateEndpointSubnetResourceId": {
-                            "value": "[parameters('privateEndpointSubnetResourceId')]"
-                          },
-                          "blobPrivateDnsZoneResourceId": {
-                            "value": "[tryGet(parameters('storageAccountConfiguration'), 'blobPrivateDnsZoneResourceId')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[concat(if(and(not(empty(parameters('storageAccountConfiguration'))), not(empty(tryGet(parameters('storageAccountConfiguration'), 'roleAssignments')))), parameters('storageAccountConfiguration').roleAssignments, createArray()), createArray(createObject('principalId', reference('foundryAccount').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), if(empty(tryGet(parameters('aiSearchConfiguration'), 'existingResourceId')), createArray(createObject('principalId', reference('aiSearch').outputs.systemAssignedMIPrincipalId.value, 'principalType', 'ServicePrincipal', 'roleDefinitionIdOrName', 'Storage Blob Data Contributor')), createArray()))]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "10412454114821386555"
-                            }
-                          },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "functions": [
-                            {
-                              "namespace": "__bicep",
-                              "members": {
-                                "getResourceGroupName": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Group Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceName": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    },
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceParts": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
-                                  },
-                                  "metadata": {
-                                    "description": "Splits Resource ID into its components.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getSubscriptionId": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Subscription ID from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          ],
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "maxLength": 24,
-                              "metadata": {
-                                "description": "Required. The name of the storage account."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The location for the storage account."
-                              }
-                            },
-                            "existingResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The full resource ID of an existing storage account to use instead of creating a new one."
-                              }
-                            },
-                            "privateEndpointSubnetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'blobPrivateDnsZoneResourceId' to establish private endpoints."
-                              }
-                            },
-                            "blobPrivateDnsZoneResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the private DNS zone for the storage account blob service to establish private endpoints."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Specifies the role assignments for the storage account."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                                },
-                                "description": "Optional. Specifies the resource tags for all the resources."
-                              },
-                              "defaultValue": {}
-                            }
-                          },
-                          "variables": {
-                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
-                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
-                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
-                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
-                            "privateNetworkingEnabled": "[and(not(empty(parameters('blobPrivateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
-                          },
-                          "resources": {
-                            "existingStorageAccount": {
-                              "condition": "[not(empty(parameters('existingResourceId')))]",
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2025-01-01",
-                              "subscriptionId": "[variables('existingSubscriptionId')]",
-                              "resourceGroup": "[variables('existingResourceGroupName')]",
-                              "name": "[variables('existingName')]"
-                            },
-                            "storageAccount": {
-                              "condition": "[empty(parameters('existingResourceId'))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('avm.res.storage.storage-account.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "tags": {
-                                    "value": "[parameters('tags')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[parameters('enableTelemetry')]"
-                                  },
-                                  "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), createObject('value', 'Disabled'), createObject('value', 'Enabled'))]",
-                                  "accessTier": {
-                                    "value": "Hot"
-                                  },
-                                  "allowBlobPublicAccess": {
-                                    "value": "[not(variables('privateNetworkingEnabled'))]"
-                                  },
-                                  "allowSharedKeyAccess": {
-                                    "value": false
-                                  },
-                                  "allowCrossTenantReplication": {
-                                    "value": false
-                                  },
-                                  "blobServices": {
-                                    "value": {
-                                      "deleteRetentionPolicyEnabled": true,
-                                      "deleteRetentionPolicyDays": 7,
-                                      "containerDeleteRetentionPolicyEnabled": true,
-                                      "containerDeleteRetentionPolicyDays": 7
-                                    }
-                                  },
-                                  "minimumTlsVersion": {
-                                    "value": "TLS1_2"
-                                  },
-                                  "networkAcls": {
-                                    "value": {
-                                      "defaultAction": "[if(variables('privateNetworkingEnabled'), 'Deny', 'Allow')]",
-                                      "bypass": "AzureServices"
-                                    }
-                                  },
-                                  "supportsHttpsTrafficOnly": {
-                                    "value": true
-                                  },
-                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('blobPrivateDnsZoneResourceId')))), 'service', 'blob', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
-                                  "roleAssignments": {
-                                    "value": "[parameters('roleAssignments')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "3530476863855541150"
-                                    },
-                                    "name": "Storage Accounts",
-                                    "description": "This module deploys a Storage Account."
-                                  },
-                                  "definitions": {
-                                    "privateEndpointOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The name of the private endpoint."
-                                          }
-                                        },
-                                        "resourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resource ID of the private endpoint."
-                                          }
-                                        },
-                                        "groupId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "The group Id for the private endpoint Group."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "fqdn": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "FQDN that resolves to private endpoint IP address."
-                                                }
-                                              },
-                                              "ipAddresses": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "string"
-                                                },
-                                                "metadata": {
-                                                  "description": "A list of private IP addresses of the private endpoint."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "The custom DNS configurations of the private endpoint."
-                                          }
-                                        },
-                                        "networkInterfaceResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for the private endpoints output."
-                                      }
-                                    },
-                                    "networkAclsType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "resourceAccessRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "tenantId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The ID of the tenant in which the resource resides in."
-                                                }
-                                              },
-                                              "resourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource ID of the target service. Can also contain a wildcard, if multiple services e.g. in a resource group should be included."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Sets the resource access rules. Array entries must consist of \"tenantId\" and \"resourceId\" fields only."
-                                          }
-                                        },
-                                        "bypass": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureServices",
-                                            "AzureServices, Logging",
-                                            "AzureServices, Logging, Metrics",
-                                            "AzureServices, Metrics",
-                                            "Logging",
-                                            "Logging, Metrics",
-                                            "Metrics",
-                                            "None"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specifies whether traffic is bypassed for Logging/Metrics/AzureServices. Possible values are any combination of Logging,Metrics,AzureServices (For example, \"Logging, Metrics\"), or None to bypass none of those traffics."
-                                          }
-                                        },
-                                        "virtualNetworkRules": {
-                                          "type": "array",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Sets the virtual network rules."
-                                          }
-                                        },
-                                        "ipRules": {
-                                          "type": "array",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Sets the IP ACL rules."
-                                          }
-                                        },
-                                        "defaultAction": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Allow",
-                                            "Deny"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specifies the default action of allow or deny when no other rules match."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for the network configuration."
-                                      }
-                                    },
-                                    "secretsExportConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "keyVaultResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The key vault name where to store the keys and connection strings generated by the modules."
-                                          }
-                                        },
-                                        "accessKey1Name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The accessKey1 secret name to create."
-                                          }
-                                        },
-                                        "connectionString1Name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The connectionString1 secret name to create."
-                                          }
-                                        },
-                                        "accessKey2Name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The accessKey2 secret name to create."
-                                          }
-                                        },
-                                        "connectionString2Name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The connectionString2 secret name to create."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type of the exported secrets."
-                                      }
-                                    },
-                                    "localUserType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the local user used for SFTP Authentication."
-                                          }
-                                        },
-                                        "hasSharedKey": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
-                                          }
-                                        },
-                                        "hasSshKey": {
-                                          "type": "bool",
-                                          "metadata": {
-                                            "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
-                                          }
-                                        },
-                                        "hasSshPassword": {
-                                          "type": "bool",
-                                          "metadata": {
-                                            "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
-                                          }
-                                        },
-                                        "homeDirectory": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The local user home directory."
-                                          }
-                                        },
-                                        "permissionScopes": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/permissionScopeType"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The permission scopes of the local user."
-                                          }
-                                        },
-                                        "sshAuthorizedKeys": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/sshAuthorizedKeyType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The local user SSH authorized keys for SFTP."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type of a local user."
-                                      }
-                                    },
-                                    "blobServiceType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "automaticSnapshotPolicyEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Automatic Snapshot is enabled if set to true."
-                                          }
-                                        },
-                                        "changeFeedEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
-                                          }
-                                        },
-                                        "changeFeedRetentionInDays": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "minValue": 1,
-                                          "maxValue": 146000,
-                                          "metadata": {
-                                            "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
-                                          }
-                                        },
-                                        "containerDeleteRetentionPolicyEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
-                                          }
-                                        },
-                                        "containerDeleteRetentionPolicyDays": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "minValue": 1,
-                                          "maxValue": 365,
-                                          "metadata": {
-                                            "description": "Optional. Indicates the number of days that the deleted item should be retained."
-                                          }
-                                        },
-                                        "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                                          }
-                                        },
-                                        "corsRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/corsRuleType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                                          }
-                                        },
-                                        "defaultServiceVersion": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
-                                          }
-                                        },
-                                        "deleteRetentionPolicyEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The blob service properties for blob soft delete."
-                                          }
-                                        },
-                                        "deleteRetentionPolicyDays": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "minValue": 1,
-                                          "maxValue": 365,
-                                          "metadata": {
-                                            "description": "Optional. Indicates the number of days that the deleted blob should be retained."
-                                          }
-                                        },
-                                        "deleteRetentionPolicyAllowPermanentDelete": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                                          }
-                                        },
-                                        "isVersioningEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
-                                          }
-                                        },
-                                        "lastAccessTimeTrackingPolicyEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
-                                          }
-                                        },
-                                        "restorePolicyEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
-                                          }
-                                        },
-                                        "restorePolicyDays": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "minValue": 1,
-                                          "metadata": {
-                                            "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
-                                          }
-                                        },
-                                        "containers": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/containerType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Blob containers to create."
-                                          }
-                                        },
-                                        "diagnosticSettings": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/diagnosticSettingFullType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The diagnostic settings of the service."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type of a blob service."
-                                      }
-                                    },
-                                    "_1.immutabilityPolicyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "immutabilityPeriodSinceCreationInDays": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                          }
-                                        },
-                                        "allowProtectedAppendWrites": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                                          }
-                                        },
-                                        "allowProtectedAppendWritesAll": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "The type for an immutability policy.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "blob-service/container/main.bicep"
-                                        }
-                                      }
-                                    },
-                                    "_2.secretSetOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "secretResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resourceId of the exported secret."
-                                          }
-                                        },
-                                        "secretUri": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The secret URI of the exported secret."
-                                          }
-                                        },
-                                        "secretUriWithVersion": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The secret URI with version of the exported secret."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "_3.lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_3.privateEndpointCustomDnsConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "fqdn": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                          }
-                                        },
-                                        "ipAddresses": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of private IP addresses of the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_3.privateEndpointIpConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the resource that is unique within a resource group."
-                                          }
-                                        },
-                                        "properties": {
-                                          "type": "object",
-                                          "properties": {
-                                            "groupId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "memberName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "privateIPAddress": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Properties of private endpoint IP configurations."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_3.privateEndpointPrivateDnsZoneGroupType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private DNS Zone Group."
-                                          }
-                                        },
-                                        "privateDnsZoneGroupConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "name": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                                }
-                                              },
-                                              "privateDnsZoneResourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource id of the private DNS zone."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_3.roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "containerType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the Storage Container to deploy."
-                                          }
-                                        },
-                                        "defaultEncryptionScope": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Default the container to use specified encryption scope for all writes."
-                                          }
-                                        },
-                                        "denyEncryptionScopeOverride": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Block override of encryption scope from the container default."
-                                          }
-                                        },
-                                        "enableNfsV3AllSquash": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable NFSv3 all squash on blob container."
-                                          }
-                                        },
-                                        "enableNfsV3RootSquash": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable NFSv3 root squash on blob container."
-                                          }
-                                        },
-                                        "immutableStorageWithVersioningEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                                          }
-                                        },
-                                        "immutabilityPolicy": {
-                                          "$ref": "#/definitions/_1.immutabilityPolicyType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Configure immutability policy."
-                                          }
-                                        },
-                                        "metadata": {
-                                          "type": "object",
-                                          "metadata": {
-                                            "__bicep_resource_derived_type!": {
-                                              "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
-                                            },
-                                            "description": "Optional. A name-value pair to associate with the container as metadata."
-                                          },
-                                          "nullable": true
-                                        },
-                                        "publicAccess": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Blob",
-                                            "Container",
-                                            "None"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_3.roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "The type of a storage container.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "blob-service/main.bicep"
-                                        }
-                                      }
-                                    },
-                                    "corsRuleType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "allowedHeaders": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                          }
-                                        },
-                                        "allowedMethods": {
-                                          "type": "array",
-                                          "allowedValues": [
-                                            "CONNECT",
-                                            "DELETE",
-                                            "GET",
-                                            "HEAD",
-                                            "MERGE",
-                                            "OPTIONS",
-                                            "PATCH",
-                                            "POST",
-                                            "PUT",
-                                            "TRACE"
-                                          ],
-                                          "metadata": {
-                                            "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                          }
-                                        },
-                                        "allowedOrigins": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                          }
-                                        },
-                                        "exposedHeaders": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of response headers to expose to CORS clients."
-                                          }
-                                        },
-                                        "maxAgeInSeconds": {
-                                          "type": "int",
-                                          "metadata": {
-                                            "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "The type for a cors rule.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "blob-service/main.bicep"
-                                        }
-                                      }
-                                    },
-                                    "customerManagedKeyWithAutoRotateType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "keyVaultResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The resource ID of a key vault to reference a customer managed key for encryption from."
-                                          }
-                                        },
-                                        "keyName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the customer managed key to use for encryption."
-                                          }
-                                        },
-                                        "keyVersion": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The version of the customer managed key to reference for encryption. If not provided, using version as per 'autoRotationEnabled' setting."
-                                          }
-                                        },
-                                        "autoRotationEnabled": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable or disable auto-rotating to the latest key version. Default is `true`. If set to `false`, the latest key version at the time of the deployment is used."
-                                          }
-                                        },
-                                        "userAssignedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a customer-managed key. To be used if the resource type supports auto-rotation of the customer-managed key.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "diagnosticSettingFullType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the diagnostic setting."
-                                          }
-                                        },
-                                        "logCategoriesAndGroups": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                }
-                                              },
-                                              "categoryGroup": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                          }
-                                        },
-                                        "metricCategories": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                          }
-                                        },
-                                        "logAnalyticsDestinationType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureDiagnostics",
-                                            "Dedicated"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                          }
-                                        },
-                                        "workspaceResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "storageAccountResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "eventHubAuthorizationRuleResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                          }
-                                        },
-                                        "eventHubName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "marketplacePartnerResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "diagnosticSettingMetricsOnlyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of diagnostic setting."
-                                          }
-                                        },
-                                        "metricCategories": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                          }
-                                        },
-                                        "logAnalyticsDestinationType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureDiagnostics",
-                                            "Dedicated"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                          }
-                                        },
-                                        "workspaceResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "storageAccountResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "eventHubAuthorizationRuleResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                          }
-                                        },
-                                        "eventHubName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "marketplacePartnerResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "managedIdentityAllType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "systemAssigned": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enables system assigned managed identity on the resource."
-                                          }
-                                        },
-                                        "userAssignedResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "permissionScopeType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "permissions": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
-                                          }
-                                        },
-                                        "resourceName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
-                                          }
-                                        },
-                                        "service": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The service used by the local user, e.g. blob, file."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "local-user/main.bicep"
-                                        }
-                                      }
-                                    },
-                                    "privateEndpointMultiServiceType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private endpoint."
-                                          }
-                                        },
-                                        "location": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The location to deploy the private endpoint to."
-                                          }
-                                        },
-                                        "privateLinkServiceConnectionName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private link connection to create."
-                                          }
-                                        },
-                                        "service": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
-                                          }
-                                        },
-                                        "subnetResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                          }
-                                        },
-                                        "resourceGroupResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                                          }
-                                        },
-                                        "privateDnsZoneGroup": {
-                                          "$ref": "#/definitions/_3.privateEndpointPrivateDnsZoneGroupType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                          }
-                                        },
-                                        "isManualConnection": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. If Manual Private Link Connection is required."
-                                          }
-                                        },
-                                        "manualConnectionRequestMessage": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "maxLength": 140,
-                                          "metadata": {
-                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_3.privateEndpointCustomDnsConfigType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Custom DNS configurations."
-                                          }
-                                        },
-                                        "ipConfigurations": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_3.privateEndpointIpConfigurationType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                          }
-                                        },
-                                        "applicationSecurityGroupResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                          }
-                                        },
-                                        "customNetworkInterfaceName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                          }
-                                        },
-                                        "lock": {
-                                          "$ref": "#/definitions/_3.lockType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_3.roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "__bicep_resource_derived_type!": {
-                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                                            },
-                                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                          }
-                                        },
-                                        "enableTelemetry": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable/Disable usage telemetry for module."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "secretsOutputType": {
-                                      "type": "object",
-                                      "properties": {},
-                                      "additionalProperties": {
-                                        "$ref": "#/definitions/_2.secretSetOutputType",
-                                        "metadata": {
-                                          "description": "An exported secret's references."
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "A map of the exported secrets",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                        }
-                                      }
-                                    },
-                                    "sshAuthorizedKeyType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Description used to store the function/usage of the key."
-                                          }
-                                        },
-                                        "key": {
-                                          "type": "securestring",
-                                          "metadata": {
-                                            "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "local-user/main.bicep"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "maxLength": 24,
-                                      "metadata": {
-                                        "description": "Required. Name of the Storage Account. Must be lower-case."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "defaultValue": "[resourceGroup().location]",
-                                      "metadata": {
-                                        "description": "Optional. Location for all resources."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Array of role assignments to create."
-                                      }
-                                    },
-                                    "managedIdentities": {
-                                      "$ref": "#/definitions/managedIdentityAllType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The managed identity definition for this resource."
-                                      }
-                                    },
-                                    "kind": {
-                                      "type": "string",
-                                      "defaultValue": "StorageV2",
-                                      "allowedValues": [
-                                        "Storage",
-                                        "StorageV2",
-                                        "BlobStorage",
-                                        "FileStorage",
-                                        "BlockBlobStorage"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Type of Storage Account to create."
-                                      }
-                                    },
-                                    "skuName": {
-                                      "type": "string",
-                                      "defaultValue": "Standard_GRS",
-                                      "allowedValues": [
-                                        "Standard_LRS",
-                                        "Standard_ZRS",
-                                        "Standard_GRS",
-                                        "Standard_GZRS",
-                                        "Standard_RAGRS",
-                                        "Standard_RAGZRS",
-                                        "StandardV2_LRS",
-                                        "StandardV2_ZRS",
-                                        "StandardV2_GRS",
-                                        "StandardV2_GZRS",
-                                        "Premium_LRS",
-                                        "Premium_ZRS",
-                                        "PremiumV2_LRS",
-                                        "PremiumV2_ZRS"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Storage Account Sku Name - note: certain V2 SKUs require the use of: kind = FileStorage."
-                                      }
-                                    },
-                                    "accessTier": {
-                                      "type": "string",
-                                      "defaultValue": "Hot",
-                                      "allowedValues": [
-                                        "Premium",
-                                        "Hot",
-                                        "Cool",
-                                        "Cold"
-                                      ],
-                                      "metadata": {
-                                        "description": "Conditional. Required if the Storage Account kind is set to BlobStorage. The access tier is used for billing. The \"Premium\" access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type."
-                                      }
-                                    },
-                                    "largeFileSharesState": {
-                                      "type": "string",
-                                      "defaultValue": "Disabled",
-                                      "allowedValues": [
-                                        "Disabled",
-                                        "Enabled"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Allow large file shares if set to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares)."
-                                      }
-                                    },
-                                    "azureFilesIdentityBasedAuthentication": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/properties/properties/azureFilesIdentityBasedAuthentication"
-                                        },
-                                        "description": "Optional. Provides the identity based authentication settings for Azure Files."
-                                      },
-                                      "nullable": true
-                                    },
-                                    "defaultToOAuthAuthentication": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. A boolean flag which indicates whether the default authentication is OAuth or not."
-                                      }
-                                    },
-                                    "allowSharedKeyAccess": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true."
-                                      }
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointMultiServiceType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible."
-                                      }
-                                    },
-                                    "managementPolicyRules": {
-                                      "type": "array",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The Storage Account ManagementPolicies Rules."
-                                      }
-                                    },
-                                    "networkAcls": {
-                                      "$ref": "#/definitions/networkAclsType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Networks ACLs, this value contains IPs to whitelist and/or Subnet information. If in use, bypass needs to be supplied. For security reasons, it is recommended to set the DefaultAction Deny."
-                                      }
-                                    },
-                                    "requireInfrastructureEncryption": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true."
-                                      }
-                                    },
-                                    "allowCrossTenantReplication": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Allow or disallow cross AAD tenant object replication."
-                                      }
-                                    },
-                                    "customDomainName": {
-                                      "type": "string",
-                                      "defaultValue": "",
-                                      "metadata": {
-                                        "description": "Optional. Sets the custom domain name assigned to the storage account. Name is the CNAME source."
-                                      }
-                                    },
-                                    "customDomainUseSubDomainName": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Indicates whether indirect CName validation is enabled. This should only be set on updates."
-                                      }
-                                    },
-                                    "dnsEndpointType": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "AzureDnsZone",
-                                        "Standard"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier."
-                                      }
-                                    },
-                                    "blobServices": {
-                                      "$ref": "#/definitions/blobServiceType",
-                                      "defaultValue": "[if(not(equals(parameters('kind'), 'FileStorage')), createObject('containerDeleteRetentionPolicyEnabled', true(), 'containerDeleteRetentionPolicyDays', 7, 'deleteRetentionPolicyEnabled', true(), 'deleteRetentionPolicyDays', 6), createObject())]",
-                                      "metadata": {
-                                        "description": "Optional. Blob service and containers to deploy."
-                                      }
-                                    },
-                                    "fileServices": {
-                                      "type": "object",
-                                      "defaultValue": {},
-                                      "metadata": {
-                                        "description": "Optional. File service and shares to deploy."
-                                      }
-                                    },
-                                    "queueServices": {
-                                      "type": "object",
-                                      "defaultValue": {},
-                                      "metadata": {
-                                        "description": "Optional. Queue service and queues to create."
-                                      }
-                                    },
-                                    "tableServices": {
-                                      "type": "object",
-                                      "defaultValue": {},
-                                      "metadata": {
-                                        "description": "Optional. Table service and tables to create."
-                                      }
-                                    },
-                                    "allowBlobPublicAccess": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Indicates whether public access is enabled for all blobs or containers in the storage account. For security reasons, it is recommended to set it to false."
-                                      }
-                                    },
-                                    "minimumTlsVersion": {
-                                      "type": "string",
-                                      "defaultValue": "TLS1_2",
-                                      "allowedValues": [
-                                        "TLS1_2"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Set the minimum TLS version on request to storage. The TLS versions 1.0 and 1.1 are deprecated and not supported anymore."
-                                      }
-                                    },
-                                    "enableHierarchicalNamespace": {
-                                      "type": "bool",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Conditional. If true, enables Hierarchical Namespace for the storage account. Required if enableSftp or enableNfsV3 is set to true."
-                                      }
-                                    },
-                                    "enableSftp": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true."
-                                      }
-                                    },
-                                    "localUsers": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/localUserType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Local users to deploy for SFTP authentication."
-                                      }
-                                    },
-                                    "isLocalUserEnabled": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Enables local users feature, if set to true."
-                                      }
-                                    },
-                                    "enableNfsV3": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true."
-                                      }
-                                    },
-                                    "diagnosticSettings": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The diagnostic settings of the service."
-                                      }
-                                    },
-                                    "lock": {
-                                      "$ref": "#/definitions/lockType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The lock settings of the service."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.Storage/storageAccounts@2024-01-01#properties/tags"
-                                        },
-                                        "description": "Optional. Tags of the resource."
-                                      },
-                                      "nullable": true
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    },
-                                    "allowedCopyScope": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "AAD",
-                                        "PrivateLink"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet."
-                                      }
-                                    },
-                                    "publicNetworkAccess": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "Enabled",
-                                        "Disabled"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set and networkAcls are not set."
-                                      }
-                                    },
-                                    "supportsHttpsTrafficOnly": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Allows HTTPS traffic only to storage service if sets to true."
-                                      }
-                                    },
-                                    "customerManagedKey": {
-                                      "$ref": "#/definitions/customerManagedKeyWithAutoRotateType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The customer managed key definition."
-                                      }
-                                    },
-                                    "sasExpirationPeriod": {
-                                      "type": "string",
-                                      "defaultValue": "",
-                                      "metadata": {
-                                        "description": "Optional. The SAS expiration period. DD.HH:MM:SS."
-                                      }
-                                    },
-                                    "sasExpirationAction": {
-                                      "type": "string",
-                                      "defaultValue": "Log",
-                                      "allowedValues": [
-                                        "Block",
-                                        "Log"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. The SAS expiration action. Allowed values are Block and Log."
-                                      }
-                                    },
-                                    "keyType": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "Account",
-                                        "Service"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. The keyType to use with Queue & Table services."
-                                      }
-                                    },
-                                    "secretsExportConfiguration": {
-                                      "$ref": "#/definitions/secretsExportConfigurationType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Key vault reference and secret settings for the module's secrets export."
-                                      }
-                                    },
-                                    "immutableStorageWithVersioning": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.Storage/storageAccounts@2025-01-01#properties/properties/properties/immutableStorageWithVersioning"
-                                        },
-                                        "description": "Optional. The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the new containers in the account by default. Cannot be enabled for ADLS Gen2 storage accounts."
-                                      },
-                                      "nullable": true
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "enableReferencedModulesTelemetry": false,
-                                    "immutabilityValidation": "[if(and(equals(parameters('enableHierarchicalNamespace'), true()), not(empty(parameters('immutableStorageWithVersioning')))), fail('Configuration error: Immutable storage with versioning cannot be enabled when hierarchical namespace is enabled.'), null())]",
-                                    "supportsBlobService": "[or(or(or(equals(parameters('kind'), 'BlockBlobStorage'), equals(parameters('kind'), 'BlobStorage')), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
-                                    "supportsFileService": "[or(or(equals(parameters('kind'), 'FileStorage'), equals(parameters('kind'), 'StorageV2')), equals(parameters('kind'), 'Storage'))]",
-                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                                    "builtInRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
-                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
-                                      "Storage File Data Privileged Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '69566ab7-960f-475b-8e7c-b3118f30c6bd')]",
-                                      "Storage File Data Privileged Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b8eda974-7b85-4f76-af95-65846b26df6d')]",
-                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
-                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
-                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
-                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
-                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
-                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
-                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
-                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "cMKKeyVault::cMKKey": {
-                                      "condition": "[and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), and(not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'))), not(empty(tryGet(parameters('customerManagedKey'), 'keyName')))))]",
-                                      "existing": true,
-                                      "type": "Microsoft.KeyVault/vaults/keys",
-                                      "apiVersion": "2024-11-01",
-                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                                      "name": "[format('{0}/{1}', last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')), tryGet(parameters('customerManagedKey'), 'keyName'))]"
-                                    },
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-03-01",
-                                      "name": "[format('46d3xbcp.res.storage-storageaccount.{0}.{1}', replace('0.27.1', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "cMKKeyVault": {
-                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId')))]",
-                                      "existing": true,
-                                      "type": "Microsoft.KeyVault/vaults",
-                                      "apiVersion": "2024-11-01",
-                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/')[4]]",
-                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'keyVaultResourceId'), '/'))]"
-                                    },
-                                    "cMKUserAssignedIdentity": {
-                                      "condition": "[not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId')))]",
-                                      "existing": true,
-                                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
-                                      "apiVersion": "2024-11-30",
-                                      "subscriptionId": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]]",
-                                      "name": "[last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))]"
-                                    },
-                                    "storageAccount": {
-                                      "type": "Microsoft.Storage/storageAccounts",
-                                      "apiVersion": "2024-01-01",
-                                      "name": "[parameters('name')]",
-                                      "location": "[parameters('location')]",
-                                      "kind": "[parameters('kind')]",
-                                      "sku": {
-                                        "name": "[parameters('skuName')]"
-                                      },
-                                      "identity": "[variables('identity')]",
-                                      "tags": "[parameters('tags')]",
-                                      "properties": "[shallowMerge(createArray(createObject('allowSharedKeyAccess', parameters('allowSharedKeyAccess'), 'defaultToOAuthAuthentication', parameters('defaultToOAuthAuthentication'), 'allowCrossTenantReplication', parameters('allowCrossTenantReplication'), 'allowedCopyScope', parameters('allowedCopyScope'), 'customDomain', createObject('name', parameters('customDomainName'), 'useSubDomainName', parameters('customDomainUseSubDomainName')), 'dnsEndpointType', parameters('dnsEndpointType'), 'isLocalUserEnabled', parameters('isLocalUserEnabled'), 'encryption', union(createObject('keySource', if(not(empty(parameters('customerManagedKey'))), 'Microsoft.Keyvault', 'Microsoft.Storage'), 'services', createObject('blob', if(variables('supportsBlobService'), createObject('enabled', true()), null()), 'file', if(variables('supportsFileService'), createObject('enabled', true()), null()), 'table', createObject('enabled', true(), 'keyType', parameters('keyType')), 'queue', createObject('enabled', true(), 'keyType', parameters('keyType'))), 'keyvaultproperties', if(not(empty(parameters('customerManagedKey'))), createObject('keyname', parameters('customerManagedKey').keyName, 'keyvaulturi', reference('cMKKeyVault').vaultUri, 'keyversion', if(not(empty(tryGet(parameters('customerManagedKey'), 'keyVersion'))), parameters('customerManagedKey').keyVersion, if(coalesce(tryGet(parameters('customerManagedKey'), 'autoRotationEnabled'), true()), null(), last(split(reference('cMKKeyVault::cMKKey').keyUriWithVersion, '/'))))), null()), 'identity', createObject('userAssignedIdentity', if(not(empty(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'))), extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[2], split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/')[4]), 'Microsoft.ManagedIdentity/userAssignedIdentities', last(split(tryGet(parameters('customerManagedKey'), 'userAssignedIdentityResourceId'), '/'))), null()))), if(parameters('requireInfrastructureEncryption'), createObject('requireInfrastructureEncryption', if(not(equals(parameters('kind'), 'Storage')), parameters('requireInfrastructureEncryption'), null())), createObject())), 'accessTier', if(and(not(equals(parameters('kind'), 'Storage')), not(equals(parameters('kind'), 'BlockBlobStorage'))), parameters('accessTier'), null()), 'sasPolicy', if(not(empty(parameters('sasExpirationPeriod'))), createObject('expirationAction', parameters('sasExpirationAction'), 'sasExpirationPeriod', parameters('sasExpirationPeriod')), null()), 'supportsHttpsTrafficOnly', parameters('supportsHttpsTrafficOnly'), 'isSftpEnabled', parameters('enableSftp'), 'isNfsV3Enabled', if(parameters('enableNfsV3'), parameters('enableNfsV3'), ''), 'largeFileSharesState', if(or(equals(parameters('skuName'), 'Standard_LRS'), equals(parameters('skuName'), 'Standard_ZRS')), parameters('largeFileSharesState'), null()), 'minimumTlsVersion', parameters('minimumTlsVersion'), 'networkAcls', if(not(empty(parameters('networkAcls'))), union(createObject('resourceAccessRules', tryGet(parameters('networkAcls'), 'resourceAccessRules'), 'defaultAction', coalesce(tryGet(parameters('networkAcls'), 'defaultAction'), 'Deny'), 'virtualNetworkRules', tryGet(parameters('networkAcls'), 'virtualNetworkRules'), 'ipRules', tryGet(parameters('networkAcls'), 'ipRules')), if(contains(parameters('networkAcls'), 'bypass'), createObject('bypass', tryGet(parameters('networkAcls'), 'bypass')), createObject())), createObject('bypass', 'AzureServices', 'defaultAction', 'Deny')), 'allowBlobPublicAccess', parameters('allowBlobPublicAccess'), 'publicNetworkAccess', if(not(empty(parameters('publicNetworkAccess'))), parameters('publicNetworkAccess'), if(and(not(empty(parameters('privateEndpoints'))), empty(parameters('networkAcls'))), 'Disabled', null()))), if(not(empty(parameters('azureFilesIdentityBasedAuthentication'))), createObject('azureFilesIdentityBasedAuthentication', parameters('azureFilesIdentityBasedAuthentication')), createObject()), if(not(equals(parameters('enableHierarchicalNamespace'), null())), createObject('isHnsEnabled', parameters('enableHierarchicalNamespace')), createObject()), createObject('immutableStorageWithVersioning', parameters('immutableStorageWithVersioning'))))]",
-                                      "dependsOn": [
-                                        "cMKKeyVault",
-                                        "cMKKeyVault::cMKKey"
-                                      ]
-                                    },
-                                    "storageAccount_diagnosticSettings": {
-                                      "copy": {
-                                        "name": "storageAccount_diagnosticSettings",
-                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Insights/diagnosticSettings",
-                                      "apiVersion": "2021-05-01-preview",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                                      "properties": {
-                                        "copy": [
-                                          {
-                                            "name": "metrics",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                            "input": {
-                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                              "timeGrain": null
-                                            }
-                                          }
-                                        ],
-                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_lock": {
-                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                      "type": "Microsoft.Authorization/locks",
-                                      "apiVersion": "2020-05-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                      "properties": {
-                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_roleAssignments": {
-                                      "copy": {
-                                        "name": "storageAccount_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_privateEndpoints": {
-                                      "copy": {
-                                        "name": "storageAccount_privateEndpoints",
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-sa-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
-                                          },
-                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.Storage/storageAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                                          "subnetResourceId": {
-                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          },
-                                          "location": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                                          },
-                                          "lock": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                                          },
-                                          "privateDnsZoneGroup": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "customDnsConfigs": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                                          },
-                                          "ipConfigurations": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                                          },
-                                          "applicationSecurityGroupResourceIds": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                                          },
-                                          "customNetworkInterfaceName": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.34.44.8038",
-                                              "templateHash": "12389807800450456797"
-                                            },
-                                            "name": "Private Endpoints",
-                                            "description": "This module deploys a Private Endpoint."
-                                          },
-                                          "definitions": {
-                                            "privateDnsZoneGroupType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                                  }
-                                                },
-                                                "privateDnsZoneGroupConfigs": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "ipConfigurationType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "memberName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "privateIPAddress": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private endpoint IP configurations."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "privateLinkServiceConnectionType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the private link service connection."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupIds": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                                      }
-                                                    },
-                                                    "privateLinkServiceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The resource id of private link service."
-                                                      }
-                                                    },
-                                                    "requestMessage": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private link service connection."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "customDnsConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "fqdn": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                                  }
-                                                },
-                                                "ipAddresses": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "lockType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the name of lock."
-                                                  }
-                                                },
-                                                "kind": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "CanNotDelete",
-                                                    "None",
-                                                    "ReadOnly"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the type of lock."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a lock.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            },
-                                            "privateDnsZoneGroupConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the private DNS zone group config."
-                                                  }
-                                                },
-                                                "privateDnsZoneResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The resource id of the private DNS zone."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                                }
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the private endpoint resource to create."
-                                              }
-                                            },
-                                            "subnetResourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                              }
-                                            },
-                                            "applicationSecurityGroupResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                              }
-                                            },
-                                            "customNetworkInterfaceName": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                              }
-                                            },
-                                            "ipConfigurations": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/ipConfigurationType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                              }
-                                            },
-                                            "privateDnsZoneGroup": {
-                                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                              }
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "defaultValue": "[resourceGroup().location]",
-                                              "metadata": {
-                                                "description": "Optional. Location for all Resources."
-                                              }
-                                            },
-                                            "lock": {
-                                              "$ref": "#/definitions/lockType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The lock settings of the service."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                              }
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Custom DNS configurations."
-                                              }
-                                            },
-                                            "manualPrivateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "privateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint": {
-                                              "type": "Microsoft.Network/privateEndpoints",
-                                              "apiVersion": "2024-05-01",
-                                              "name": "[parameters('name')]",
-                                              "location": "[parameters('location')]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "applicationSecurityGroups",
-                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                                    "input": {
-                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                                    }
-                                                  }
-                                                ],
-                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                                "subnet": {
-                                                  "id": "[parameters('subnetResourceId')]"
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint_lock": {
-                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                              "type": "Microsoft.Authorization/locks",
-                                              "apiVersion": "2020-05-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                              "properties": {
-                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_roleAssignments": {
-                                              "copy": {
-                                                "name": "privateEndpoint_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_privateDnsZoneGroup": {
-                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                                  },
-                                                  "privateEndpointName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "privateDnsZoneConfigs": {
-                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.34.44.8038",
-                                                      "templateHash": "13997305779829540948"
-                                                    },
-                                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                                  },
-                                                  "definitions": {
-                                                    "privateDnsZoneGroupConfigType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name of the private DNS zone group config."
-                                                          }
-                                                        },
-                                                        "privateDnsZoneResourceId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The resource id of the private DNS zone."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "__bicep_export!": true
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "privateEndpointName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "privateDnsZoneConfigs": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                      },
-                                                      "minLength": 1,
-                                                      "maxLength": 5,
-                                                      "metadata": {
-                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Optional. The name of the private DNS zone group."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "privateDnsZoneConfigsVar",
-                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                                        "input": {
-                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                                          "properties": {
-                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                                          }
-                                                        }
-                                                      }
-                                                    ]
-                                                  },
-                                                  "resources": {
-                                                    "privateEndpoint": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Network/privateEndpoints",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[parameters('privateEndpointName')]"
-                                                    },
-                                                    "privateDnsZoneGroup": {
-                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group the private endpoint was deployed into."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the private endpoint."
-                                              },
-                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the private endpoint."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The location the resource was deployed into."
-                                              },
-                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "metadata": {
-                                                "description": "The custom DNS configurations of the private endpoint."
-                                              },
-                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                                            },
-                                            "networkInterfaceResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "metadata": {
-                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                                              },
-                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                                            },
-                                            "groupId": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "The group Id for the private endpoint Group."
-                                              },
-                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_managementPolicies": {
-                                      "condition": "[not(empty(coalesce(parameters('managementPolicyRules'), createArray())))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Storage-ManagementPolicies', uniqueString(deployment().name, parameters('location')))]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "rules": {
-                                            "value": "[parameters('managementPolicyRules')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "14529265638306912023"
-                                            },
-                                            "name": "Storage Account Management Policies",
-                                            "description": "This module deploys a Storage Account Management Policy."
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "rules": {
-                                              "type": "array",
-                                              "metadata": {
-                                                "__bicep_resource_derived_type!": {
-                                                  "source": "Microsoft.Storage/storageAccounts/managementPolicies@2024-01-01#properties/properties/properties/policy/properties/rules"
-                                                },
-                                                "description": "Required. The Storage Account ManagementPolicies Rules."
-                                              }
-                                            }
-                                          },
-                                          "resources": [
-                                            {
-                                              "type": "Microsoft.Storage/storageAccounts/managementPolicies",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]",
-                                              "properties": {
-                                                "policy": {
-                                                  "rules": "[parameters('rules')]"
-                                                }
-                                              }
-                                            }
-                                          ],
-                                          "outputs": {
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed management policy."
-                                              },
-                                              "value": "default"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed management policy."
-                                              },
-                                              "value": "default"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group of the deployed management policy."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount",
-                                        "storageAccount_blobServices"
-                                      ]
-                                    },
-                                    "storageAccount_localUsers": {
-                                      "copy": {
-                                        "name": "storageAccount_localUsers",
-                                        "count": "[length(coalesce(parameters('localUsers'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Storage-LocalUsers-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "name": {
-                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].name]"
-                                          },
-                                          "hasSshKey": {
-                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshKey]"
-                                          },
-                                          "hasSshPassword": {
-                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].hasSshPassword]"
-                                          },
-                                          "permissionScopes": {
-                                            "value": "[coalesce(parameters('localUsers'), createArray())[copyIndex()].permissionScopes]"
-                                          },
-                                          "hasSharedKey": {
-                                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'hasSharedKey')]"
-                                          },
-                                          "homeDirectory": {
-                                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'homeDirectory')]"
-                                          },
-                                          "sshAuthorizedKeys": {
-                                            "value": "[tryGet(coalesce(parameters('localUsers'), createArray())[copyIndex()], 'sshAuthorizedKeys')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "3261275799710495788"
-                                            },
-                                            "name": "Storage Account Local Users",
-                                            "description": "This module deploys a Storage Account Local User, which is used for SFTP authentication."
-                                          },
-                                          "definitions": {
-                                            "sshAuthorizedKeyType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Description used to store the function/usage of the key."
-                                                  }
-                                                },
-                                                "key": {
-                                                  "type": "securestring",
-                                                  "metadata": {
-                                                    "description": "Required. SSH public key base64 encoded. The format should be: '{keyType} {keyData}', e.g. ssh-rsa AAAABBBB."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "permissionScopeType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "permissions": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The permissions for the local user. Possible values include: Read (r), Write (w), Delete (d), List (l), and Create (c)."
-                                                  }
-                                                },
-                                                "resourceName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of resource, normally the container name or the file share name, used by the local user."
-                                                  }
-                                                },
-                                                "service": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The service used by the local user, e.g. blob, file."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the local user used for SFTP Authentication."
-                                              }
-                                            },
-                                            "hasSharedKey": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. Indicates whether shared key exists. Set it to false to remove existing shared key."
-                                              }
-                                            },
-                                            "hasSshKey": {
-                                              "type": "bool",
-                                              "metadata": {
-                                                "description": "Required. Indicates whether SSH key exists. Set it to false to remove existing SSH key."
-                                              }
-                                            },
-                                            "hasSshPassword": {
-                                              "type": "bool",
-                                              "metadata": {
-                                                "description": "Required. Indicates whether SSH password exists. Set it to false to remove existing SSH password."
-                                              }
-                                            },
-                                            "homeDirectory": {
-                                              "type": "string",
-                                              "defaultValue": "",
-                                              "metadata": {
-                                                "description": "Optional. The local user home directory."
-                                              }
-                                            },
-                                            "permissionScopes": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/permissionScopeType"
-                                              },
-                                              "metadata": {
-                                                "description": "Required. The permission scopes of the local user."
-                                              }
-                                            },
-                                            "sshAuthorizedKeys": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/sshAuthorizedKeyType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The local user SSH authorized keys for SFTP."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "storageAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.Storage/storageAccounts",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[parameters('storageAccountName')]"
-                                            },
-                                            "localUsers": {
-                                              "type": "Microsoft.Storage/storageAccounts/localUsers",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
-                                              "properties": {
-                                                "hasSharedKey": "[parameters('hasSharedKey')]",
-                                                "hasSshKey": "[parameters('hasSshKey')]",
-                                                "hasSshPassword": "[parameters('hasSshPassword')]",
-                                                "homeDirectory": "[parameters('homeDirectory')]",
-                                                "permissionScopes": "[parameters('permissionScopes')]",
-                                                "sshAuthorizedKeys": "[parameters('sshAuthorizedKeys')]"
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed local user."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group of the deployed local user."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed local user."
-                                              },
-                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/localUsers', parameters('storageAccountName'), parameters('name'))]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_blobServices": {
-                                      "condition": "[not(empty(parameters('blobServices')))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Storage-BlobServices', uniqueString(deployment().name, parameters('location')))]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "containers": {
-                                            "value": "[tryGet(parameters('blobServices'), 'containers')]"
-                                          },
-                                          "automaticSnapshotPolicyEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'automaticSnapshotPolicyEnabled')]"
-                                          },
-                                          "changeFeedEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'changeFeedEnabled')]"
-                                          },
-                                          "changeFeedRetentionInDays": {
-                                            "value": "[tryGet(parameters('blobServices'), 'changeFeedRetentionInDays')]"
-                                          },
-                                          "containerDeleteRetentionPolicyEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyEnabled')]"
-                                          },
-                                          "containerDeleteRetentionPolicyDays": {
-                                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyDays')]"
-                                          },
-                                          "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                                            "value": "[tryGet(parameters('blobServices'), 'containerDeleteRetentionPolicyAllowPermanentDelete')]"
-                                          },
-                                          "corsRules": {
-                                            "value": "[tryGet(parameters('blobServices'), 'corsRules')]"
-                                          },
-                                          "defaultServiceVersion": {
-                                            "value": "[tryGet(parameters('blobServices'), 'defaultServiceVersion')]"
-                                          },
-                                          "deleteRetentionPolicyAllowPermanentDelete": {
-                                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyAllowPermanentDelete')]"
-                                          },
-                                          "deleteRetentionPolicyEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyEnabled')]"
-                                          },
-                                          "deleteRetentionPolicyDays": {
-                                            "value": "[tryGet(parameters('blobServices'), 'deleteRetentionPolicyDays')]"
-                                          },
-                                          "isVersioningEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'isVersioningEnabled')]"
-                                          },
-                                          "lastAccessTimeTrackingPolicyEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'lastAccessTimeTrackingPolicyEnabled')]"
-                                          },
-                                          "restorePolicyEnabled": {
-                                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyEnabled')]"
-                                          },
-                                          "restorePolicyDays": {
-                                            "value": "[tryGet(parameters('blobServices'), 'restorePolicyDays')]"
-                                          },
-                                          "diagnosticSettings": {
-                                            "value": "[tryGet(parameters('blobServices'), 'diagnosticSettings')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "9925173705553594819"
-                                            },
-                                            "name": "Storage Account blob Services",
-                                            "description": "This module deploys a Storage Account Blob Service."
-                                          },
-                                          "definitions": {
-                                            "corsRuleType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "allowedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                                  }
-                                                },
-                                                "allowedMethods": {
-                                                  "type": "array",
-                                                  "allowedValues": [
-                                                    "CONNECT",
-                                                    "DELETE",
-                                                    "GET",
-                                                    "HEAD",
-                                                    "MERGE",
-                                                    "OPTIONS",
-                                                    "PATCH",
-                                                    "POST",
-                                                    "PUT",
-                                                    "TRACE"
-                                                  ],
-                                                  "metadata": {
-                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                                  }
-                                                },
-                                                "allowedOrigins": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                                  }
-                                                },
-                                                "exposedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                                  }
-                                                },
-                                                "maxAgeInSeconds": {
-                                                  "type": "int",
-                                                  "metadata": {
-                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for a cors rule."
-                                              }
-                                            },
-                                            "containerType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the Storage Container to deploy."
-                                                  }
-                                                },
-                                                "defaultEncryptionScope": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Default the container to use specified encryption scope for all writes."
-                                                  }
-                                                },
-                                                "denyEncryptionScopeOverride": {
-                                                  "type": "bool",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Block override of encryption scope from the container default."
-                                                  }
-                                                },
-                                                "enableNfsV3AllSquash": {
-                                                  "type": "bool",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Enable NFSv3 all squash on blob container."
-                                                  }
-                                                },
-                                                "enableNfsV3RootSquash": {
-                                                  "type": "bool",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Enable NFSv3 root squash on blob container."
-                                                  }
-                                                },
-                                                "immutableStorageWithVersioningEnabled": {
-                                                  "type": "bool",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                                                  }
-                                                },
-                                                "immutabilityPolicy": {
-                                                  "$ref": "#/definitions/immutabilityPolicyType",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Configure immutability policy."
-                                                  }
-                                                },
-                                                "metadata": {
-                                                  "type": "object",
-                                                  "metadata": {
-                                                    "__bicep_resource_derived_type!": {
-                                                      "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
-                                                    },
-                                                    "description": "Optional. A name-value pair to associate with the container as metadata."
-                                                  },
-                                                  "nullable": true
-                                                },
-                                                "publicAccess": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Blob",
-                                                    "Container",
-                                                    "None"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                                                  }
-                                                },
-                                                "roleAssignments": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "$ref": "#/definitions/roleAssignmentType"
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Array of role assignments to create."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type of a storage container."
-                                              }
-                                            },
-                                            "diagnosticSettingFullType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the diagnostic setting."
-                                                  }
-                                                },
-                                                "logCategoriesAndGroups": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                        }
-                                                      },
-                                                      "categoryGroup": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                                  }
-                                                },
-                                                "metricCategories": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "metadata": {
-                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                                  }
-                                                },
-                                                "logAnalyticsDestinationType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "AzureDiagnostics",
-                                                    "Dedicated"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                                  }
-                                                },
-                                                "workspaceResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "storageAccountResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "eventHubAuthorizationRuleResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                                  }
-                                                },
-                                                "eventHubName": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "marketplacePartnerResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                                }
-                                              }
-                                            },
-                                            "immutabilityPolicyType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "immutabilityPeriodSinceCreationInDays": {
-                                                  "type": "int",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                                  }
-                                                },
-                                                "allowProtectedAppendWrites": {
-                                                  "type": "bool",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                                                  }
-                                                },
-                                                "allowProtectedAppendWritesAll": {
-                                                  "type": "bool",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "The type for an immutability policy.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "container/main.bicep"
-                                                }
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "automaticSnapshotPolicyEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. Automatic Snapshot is enabled if set to true."
-                                              }
-                                            },
-                                            "changeFeedEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. The blob service properties for change feed events. Indicates whether change feed event logging is enabled for the Blob service."
-                                              }
-                                            },
-                                            "changeFeedRetentionInDays": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "minValue": 1,
-                                              "maxValue": 146000,
-                                              "metadata": {
-                                                "description": "Optional. Indicates whether change feed event logging is enabled for the Blob service. Indicates the duration of changeFeed retention in days. If left blank, it indicates an infinite retention of the change feed."
-                                              }
-                                            },
-                                            "containerDeleteRetentionPolicyEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. The blob service properties for container soft delete. Indicates whether DeleteRetentionPolicy is enabled."
-                                              }
-                                            },
-                                            "containerDeleteRetentionPolicyDays": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "minValue": 1,
-                                              "maxValue": 365,
-                                              "metadata": {
-                                                "description": "Optional. Indicates the number of days that the deleted item should be retained."
-                                              }
-                                            },
-                                            "containerDeleteRetentionPolicyAllowPermanentDelete": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                                              }
-                                            },
-                                            "corsRules": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/corsRuleType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                                              }
-                                            },
-                                            "defaultServiceVersion": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Indicates the default version to use for requests to the Blob service if an incoming request's version is not specified. Possible values include version 2008-10-27 and all more recent versions."
-                                              }
-                                            },
-                                            "deleteRetentionPolicyEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. The blob service properties for blob soft delete."
-                                              }
-                                            },
-                                            "deleteRetentionPolicyDays": {
-                                              "type": "int",
-                                              "defaultValue": 7,
-                                              "minValue": 1,
-                                              "maxValue": 365,
-                                              "metadata": {
-                                                "description": "Optional. Indicates the number of days that the deleted blob should be retained."
-                                              }
-                                            },
-                                            "deleteRetentionPolicyAllowPermanentDelete": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. This property when set to true allows deletion of the soft deleted blob versions and snapshots. This property cannot be used with blob restore policy. This property only applies to blob service and does not apply to containers or file share."
-                                              }
-                                            },
-                                            "isVersioningEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. Use versioning to automatically maintain previous versions of your blobs. Cannot be enabled for ADLS Gen2 storage accounts."
-                                              }
-                                            },
-                                            "lastAccessTimeTrackingPolicyEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. The blob service property to configure last access time based tracking policy. When set to true last access time based tracking is enabled."
-                                              }
-                                            },
-                                            "restorePolicyEnabled": {
-                                              "type": "bool",
-                                              "defaultValue": false,
-                                              "metadata": {
-                                                "description": "Optional. The blob service properties for blob restore policy. If point-in-time restore is enabled, then versioning, change feed, and blob soft delete must also be enabled."
-                                              }
-                                            },
-                                            "restorePolicyDays": {
-                                              "type": "int",
-                                              "defaultValue": 7,
-                                              "minValue": 1,
-                                              "metadata": {
-                                                "description": "Optional. How long this blob can be restored. It should be less than DeleteRetentionPolicy days."
-                                              }
-                                            },
-                                            "containers": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/containerType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Blob containers to create."
-                                              }
-                                            },
-                                            "diagnosticSettings": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/diagnosticSettingFullType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The diagnostic settings of the service."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "enableReferencedModulesTelemetry": false,
-                                            "name": "default"
-                                          },
-                                          "resources": {
-                                            "storageAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.Storage/storageAccounts",
-                                              "apiVersion": "2025-01-01",
-                                              "name": "[parameters('storageAccountName')]"
-                                            },
-                                            "blobServices": {
-                                              "type": "Microsoft.Storage/storageAccounts/blobServices",
-                                              "apiVersion": "2025-01-01",
-                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                                              "properties": {
-                                                "automaticSnapshotPolicyEnabled": "[parameters('automaticSnapshotPolicyEnabled')]",
-                                                "changeFeed": "[if(parameters('changeFeedEnabled'), createObject('enabled', true(), 'retentionInDays', parameters('changeFeedRetentionInDays')), null())]",
-                                                "containerDeleteRetentionPolicy": {
-                                                  "enabled": "[parameters('containerDeleteRetentionPolicyEnabled')]",
-                                                  "days": "[parameters('containerDeleteRetentionPolicyDays')]",
-                                                  "allowPermanentDelete": "[if(equals(parameters('containerDeleteRetentionPolicyEnabled'), true()), parameters('containerDeleteRetentionPolicyAllowPermanentDelete'), null())]"
-                                                },
-                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
-                                                "defaultServiceVersion": "[parameters('defaultServiceVersion')]",
-                                                "deleteRetentionPolicy": {
-                                                  "enabled": "[parameters('deleteRetentionPolicyEnabled')]",
-                                                  "days": "[parameters('deleteRetentionPolicyDays')]",
-                                                  "allowPermanentDelete": "[if(and(parameters('deleteRetentionPolicyEnabled'), parameters('deleteRetentionPolicyAllowPermanentDelete')), true(), null())]"
-                                                },
-                                                "isVersioningEnabled": "[parameters('isVersioningEnabled')]",
-                                                "lastAccessTimeTrackingPolicy": "[if(not(equals(reference('storageAccount', '2025-01-01', 'full').kind, 'Storage')), createObject('enable', parameters('lastAccessTimeTrackingPolicyEnabled'), 'name', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 'AccessTimeTracking', null()), 'trackingGranularityInDays', if(equals(parameters('lastAccessTimeTrackingPolicyEnabled'), true()), 1, null())), null())]",
-                                                "restorePolicy": "[if(parameters('restorePolicyEnabled'), createObject('enabled', true(), 'days', parameters('restorePolicyDays')), null())]"
-                                              },
-                                              "dependsOn": [
-                                                "storageAccount"
-                                              ]
-                                            },
-                                            "blobServices_diagnosticSettings": {
-                                              "copy": {
-                                                "name": "blobServices_diagnosticSettings",
-                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Insights/diagnosticSettings",
-                                              "apiVersion": "2021-05-01-preview",
-                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "metrics",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                                    "input": {
-                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                                      "timeGrain": null
-                                                    }
-                                                  },
-                                                  {
-                                                    "name": "logs",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                                    "input": {
-                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                                    }
-                                                  }
-                                                ],
-                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                              },
-                                              "dependsOn": [
-                                                "blobServices"
-                                              ]
-                                            },
-                                            "blobServices_container": {
-                                              "copy": {
-                                                "name": "blobServices_container",
-                                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-Container-{1}', deployment().name, copyIndex())]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "storageAccountName": {
-                                                    "value": "[parameters('storageAccountName')]"
-                                                  },
-                                                  "blobServiceName": {
-                                                    "value": "[variables('name')]"
-                                                  },
-                                                  "name": {
-                                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
-                                                  },
-                                                  "defaultEncryptionScope": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultEncryptionScope')]"
-                                                  },
-                                                  "denyEncryptionScopeOverride": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'denyEncryptionScopeOverride')]"
-                                                  },
-                                                  "enableNfsV3AllSquash": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3AllSquash')]"
-                                                  },
-                                                  "enableNfsV3RootSquash": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'enableNfsV3RootSquash')]"
-                                                  },
-                                                  "immutableStorageWithVersioningEnabled": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutableStorageWithVersioningEnabled')]"
-                                                  },
-                                                  "metadata": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'metadata')]"
-                                                  },
-                                                  "publicAccess": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'publicAccess')]"
-                                                  },
-                                                  "roleAssignments": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'roleAssignments')]"
-                                                  },
-                                                  "immutabilityPolicy": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'immutabilityPolicy')]"
-                                                  },
-                                                  "enableTelemetry": {
-                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "5026123498979497429"
-                                                    },
-                                                    "name": "Storage Account Blob Containers",
-                                                    "description": "This module deploys a Storage Account Blob Container."
-                                                  },
-                                                  "definitions": {
-                                                    "immutabilityPolicyType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "immutabilityPeriodSinceCreationInDays": {
-                                                          "type": "int",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                                          }
-                                                        },
-                                                        "allowProtectedAppendWrites": {
-                                                          "type": "bool",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API."
-                                                          }
-                                                        },
-                                                        "allowProtectedAppendWritesAll": {
-                                                          "type": "bool",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "__bicep_export!": true,
-                                                        "description": "The type for an immutability policy."
-                                                      }
-                                                    },
-                                                    "roleAssignmentType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                          }
-                                                        },
-                                                        "roleDefinitionIdOrName": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                          }
-                                                        },
-                                                        "principalId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                          }
-                                                        },
-                                                        "principalType": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "Device",
-                                                            "ForeignGroup",
-                                                            "Group",
-                                                            "ServicePrincipal",
-                                                            "User"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The principal type of the assigned principal ID."
-                                                          }
-                                                        },
-                                                        "description": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The description of the role assignment."
-                                                          }
-                                                        },
-                                                        "condition": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                          }
-                                                        },
-                                                        "conditionVersion": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "2.0"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. Version of the condition."
-                                                          }
-                                                        },
-                                                        "delegatedManagedIdentityResourceId": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "description": "An AVM-aligned type for a role assignment.",
-                                                        "__bicep_imported_from!": {
-                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "storageAccountName": {
-                                                      "type": "string",
-                                                      "maxLength": 24,
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "blobServiceName": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Optional. The name of the parent Blob Service. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The name of the Storage Container to deploy."
-                                                      }
-                                                    },
-                                                    "defaultEncryptionScope": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Default the container to use specified encryption scope for all writes."
-                                                      }
-                                                    },
-                                                    "denyEncryptionScopeOverride": {
-                                                      "type": "bool",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Block override of encryption scope from the container default."
-                                                      }
-                                                    },
-                                                    "enableNfsV3AllSquash": {
-                                                      "type": "bool",
-                                                      "defaultValue": false,
-                                                      "metadata": {
-                                                        "description": "Optional. Enable NFSv3 all squash on blob container."
-                                                      }
-                                                    },
-                                                    "enableNfsV3RootSquash": {
-                                                      "type": "bool",
-                                                      "defaultValue": false,
-                                                      "metadata": {
-                                                        "description": "Optional. Enable NFSv3 root squash on blob container."
-                                                      }
-                                                    },
-                                                    "immutableStorageWithVersioningEnabled": {
-                                                      "type": "bool",
-                                                      "defaultValue": false,
-                                                      "metadata": {
-                                                        "description": "Optional. This is an immutable property, when set to true it enables object level immutability at the container level. The property is immutable and can only be set to true at the container creation time. Existing containers must undergo a migration process."
-                                                      }
-                                                    },
-                                                    "immutabilityPolicy": {
-                                                      "$ref": "#/definitions/immutabilityPolicyType",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Configure immutability policy."
-                                                      }
-                                                    },
-                                                    "metadata": {
-                                                      "type": "object",
-                                                      "metadata": {
-                                                        "__bicep_resource_derived_type!": {
-                                                          "source": "Microsoft.Storage/storageAccounts/blobServices/containers@2024-01-01#properties/properties/properties/metadata"
-                                                        },
-                                                        "description": "Optional. A name-value pair to associate with the container as metadata."
-                                                      },
-                                                      "defaultValue": {}
-                                                    },
-                                                    "publicAccess": {
-                                                      "type": "string",
-                                                      "defaultValue": "None",
-                                                      "allowedValues": [
-                                                        "Container",
-                                                        "Blob",
-                                                        "None"
-                                                      ],
-                                                      "metadata": {
-                                                        "description": "Optional. Specifies whether data in the container may be accessed publicly and the level of access."
-                                                      }
-                                                    },
-                                                    "enableTelemetry": {
-                                                      "type": "bool",
-                                                      "defaultValue": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                                      }
-                                                    },
-                                                    "roleAssignments": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/roleAssignmentType"
-                                                      },
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Array of role assignments to create."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "formattedRoleAssignments",
-                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                                      }
-                                                    ],
-                                                    "builtInRoleNames": {
-                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                                      "Storage Blob Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-                                                      "Storage Blob Data Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-                                                      "Storage Blob Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '2a2b9908-6ea1-4ae2-8e65-a410df84e7d1')]",
-                                                      "Storage Blob Delegator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db58b8e5-c6ad-4a2a-8342-4190687cbf4a')]",
-                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                                    }
-                                                  },
-                                                  "resources": {
-                                                    "storageAccount::blobServices": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts/blobServices",
-                                                      "apiVersion": "2025-01-01",
-                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('blobServiceName'))]"
-                                                    },
-                                                    "avmTelemetry": {
-                                                      "condition": "[parameters('enableTelemetry')]",
-                                                      "type": "Microsoft.Resources/deployments",
-                                                      "apiVersion": "2024-03-01",
-                                                      "name": "[format('46d3xbcp.res.storage-blobcontainer.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                                      "properties": {
-                                                        "mode": "Incremental",
-                                                        "template": {
-                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                          "contentVersion": "1.0.0.0",
-                                                          "resources": [],
-                                                          "outputs": {
-                                                            "telemetry": {
-                                                              "type": "String",
-                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                            }
-                                                          }
-                                                        }
-                                                      }
-                                                    },
-                                                    "storageAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts",
-                                                      "apiVersion": "2025-01-01",
-                                                      "name": "[parameters('storageAccountName')]"
-                                                    },
-                                                    "container": {
-                                                      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
-                                                      "apiVersion": "2025-01-01",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "defaultEncryptionScope": "[parameters('defaultEncryptionScope')]",
-                                                        "denyEncryptionScopeOverride": "[parameters('denyEncryptionScopeOverride')]",
-                                                        "enableNfsV3AllSquash": "[if(equals(parameters('enableNfsV3AllSquash'), true()), parameters('enableNfsV3AllSquash'), null())]",
-                                                        "enableNfsV3RootSquash": "[if(equals(parameters('enableNfsV3RootSquash'), true()), parameters('enableNfsV3RootSquash'), null())]",
-                                                        "immutableStorageWithVersioning": "[if(parameters('immutableStorageWithVersioningEnabled'), createObject('enabled', parameters('immutableStorageWithVersioningEnabled')), null())]",
-                                                        "metadata": "[parameters('metadata')]",
-                                                        "publicAccess": "[parameters('publicAccess')]"
-                                                      }
-                                                    },
-                                                    "container_roleAssignments": {
-                                                      "copy": {
-                                                        "name": "container_roleAssignments",
-                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                                      },
-                                                      "type": "Microsoft.Authorization/roleAssignments",
-                                                      "apiVersion": "2022-04-01",
-                                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/blobServices/{1}/containers/{2}', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]",
-                                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                                      "properties": {
-                                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                                      },
-                                                      "dependsOn": [
-                                                        "container"
-                                                      ]
-                                                    },
-                                                    "container_immutabilityPolicy": {
-                                                      "condition": "[not(empty(coalesce(parameters('immutabilityPolicy'), createObject())))]",
-                                                      "type": "Microsoft.Resources/deployments",
-                                                      "apiVersion": "2022-09-01",
-                                                      "name": "[take(format('{0}-ImmutPol', deployment().name), 64)]",
-                                                      "properties": {
-                                                        "expressionEvaluationOptions": {
-                                                          "scope": "inner"
-                                                        },
-                                                        "mode": "Incremental",
-                                                        "parameters": {
-                                                          "storageAccountName": {
-                                                            "value": "[parameters('storageAccountName')]"
-                                                          },
-                                                          "containerName": {
-                                                            "value": "[parameters('name')]"
-                                                          },
-                                                          "immutabilityPeriodSinceCreationInDays": {
-                                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'immutabilityPeriodSinceCreationInDays')]"
-                                                          },
-                                                          "allowProtectedAppendWrites": {
-                                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWrites')]"
-                                                          },
-                                                          "allowProtectedAppendWritesAll": {
-                                                            "value": "[tryGet(parameters('immutabilityPolicy'), 'allowProtectedAppendWritesAll')]"
-                                                          }
-                                                        },
-                                                        "template": {
-                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                          "contentVersion": "1.0.0.0",
-                                                          "metadata": {
-                                                            "_generator": {
-                                                              "name": "bicep",
-                                                              "version": "0.37.4.10188",
-                                                              "templateHash": "10782942397325758470"
-                                                            },
-                                                            "name": "Storage Account Blob Container Immutability Policies",
-                                                            "description": "This module deploys a Storage Account Blob Container Immutability Policy."
-                                                          },
-                                                          "parameters": {
-                                                            "storageAccountName": {
-                                                              "type": "string",
-                                                              "maxLength": 24,
-                                                              "metadata": {
-                                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                                              }
-                                                            },
-                                                            "containerName": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "Conditional. The name of the parent container to apply the policy to. Required if the template is used in a standalone deployment."
-                                                              }
-                                                            },
-                                                            "immutabilityPeriodSinceCreationInDays": {
-                                                              "type": "int",
-                                                              "defaultValue": 365,
-                                                              "metadata": {
-                                                                "description": "Optional. The immutability period for the blobs in the container since the policy creation, in days."
-                                                              }
-                                                            },
-                                                            "allowProtectedAppendWrites": {
-                                                              "type": "bool",
-                                                              "defaultValue": true,
-                                                              "metadata": {
-                                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to an append blob while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                                              }
-                                                            },
-                                                            "allowProtectedAppendWritesAll": {
-                                                              "type": "bool",
-                                                              "defaultValue": true,
-                                                              "metadata": {
-                                                                "description": "Optional. This property can only be changed for unlocked time-based retention policies. When enabled, new blocks can be written to both \"Append and Block Blobs\" while maintaining immutability protection and compliance. Only new blocks can be added and any existing blocks cannot be modified or deleted. This property cannot be changed with ExtendImmutabilityPolicy API. The \"allowProtectedAppendWrites\" and \"allowProtectedAppendWritesAll\" properties are mutually exclusive."
-                                                              }
-                                                            }
-                                                          },
-                                                          "variables": {
-                                                            "name": "default"
-                                                          },
-                                                          "resources": [
-                                                            {
-                                                              "type": "Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies",
-                                                              "apiVersion": "2025-01-01",
-                                                              "name": "[format('{0}/{1}/{2}/{3}', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]",
-                                                              "properties": {
-                                                                "immutabilityPeriodSinceCreationInDays": "[parameters('immutabilityPeriodSinceCreationInDays')]",
-                                                                "allowProtectedAppendWrites": "[parameters('allowProtectedAppendWrites')]",
-                                                                "allowProtectedAppendWritesAll": "[parameters('allowProtectedAppendWritesAll')]"
-                                                              }
-                                                            }
-                                                          ],
-                                                          "outputs": {
-                                                            "name": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "The name of the deployed immutability policy."
-                                                              },
-                                                              "value": "[variables('name')]"
-                                                            },
-                                                            "resourceId": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "The resource ID of the deployed immutability policy."
-                                                              },
-                                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies', parameters('storageAccountName'), 'default', parameters('containerName'), variables('name'))]"
-                                                            },
-                                                            "resourceGroupName": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "The resource group of the deployed immutability policy."
-                                                              },
-                                                              "value": "[resourceGroup().name]"
-                                                            }
-                                                          }
-                                                        }
-                                                      },
-                                                      "dependsOn": [
-                                                        "container"
-                                                      ]
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the deployed container."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the deployed container."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('storageAccountName'), parameters('blobServiceName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group of the deployed container."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "blobServices"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed blob service."
-                                              },
-                                              "value": "[variables('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed blob service."
-                                              },
-                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('storageAccountName'), variables('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed blob service."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_fileServices": {
-                                      "condition": "[not(empty(parameters('fileServices')))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Storage-FileServices', uniqueString(deployment().name, parameters('location')))]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "diagnosticSettings": {
-                                            "value": "[tryGet(parameters('fileServices'), 'diagnosticSettings')]"
-                                          },
-                                          "protocolSettings": {
-                                            "value": "[tryGet(parameters('fileServices'), 'protocolSettings')]"
-                                          },
-                                          "shareDeleteRetentionPolicy": {
-                                            "value": "[tryGet(parameters('fileServices'), 'shareDeleteRetentionPolicy')]"
-                                          },
-                                          "shares": {
-                                            "value": "[tryGet(parameters('fileServices'), 'shares')]"
-                                          },
-                                          "corsRules": {
-                                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "2735186993322606805"
-                                            },
-                                            "name": "Storage Account File Share Services",
-                                            "description": "This module deploys a Storage Account File Share Service."
-                                          },
-                                          "definitions": {
-                                            "corsRuleType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "allowedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                                  }
-                                                },
-                                                "allowedMethods": {
-                                                  "type": "array",
-                                                  "allowedValues": [
-                                                    "CONNECT",
-                                                    "DELETE",
-                                                    "GET",
-                                                    "HEAD",
-                                                    "MERGE",
-                                                    "OPTIONS",
-                                                    "PATCH",
-                                                    "POST",
-                                                    "PUT",
-                                                    "TRACE"
-                                                  ],
-                                                  "metadata": {
-                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                                  }
-                                                },
-                                                "allowedOrigins": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                                  }
-                                                },
-                                                "exposedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                                  }
-                                                },
-                                                "maxAgeInSeconds": {
-                                                  "type": "int",
-                                                  "metadata": {
-                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for a cors rule."
-                                              }
-                                            },
-                                            "diagnosticSettingFullType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the diagnostic setting."
-                                                  }
-                                                },
-                                                "logCategoriesAndGroups": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                        }
-                                                      },
-                                                      "categoryGroup": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                                  }
-                                                },
-                                                "metricCategories": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "metadata": {
-                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                                  }
-                                                },
-                                                "logAnalyticsDestinationType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "AzureDiagnostics",
-                                                    "Dedicated"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                                  }
-                                                },
-                                                "workspaceResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "storageAccountResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "eventHubAuthorizationRuleResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                                  }
-                                                },
-                                                "eventHubName": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "marketplacePartnerResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "defaultValue": "default",
-                                              "metadata": {
-                                                "description": "Optional. The name of the file service."
-                                              }
-                                            },
-                                            "protocolSettings": {
-                                              "type": "object",
-                                              "metadata": {
-                                                "__bicep_resource_derived_type!": {
-                                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/protocolSettings"
-                                                },
-                                                "description": "Optional. Protocol settings for file service."
-                                              },
-                                              "defaultValue": {}
-                                            },
-                                            "shareDeleteRetentionPolicy": {
-                                              "type": "object",
-                                              "metadata": {
-                                                "__bicep_resource_derived_type!": {
-                                                  "source": "Microsoft.Storage/storageAccounts/fileServices@2024-01-01#properties/properties/properties/shareDeleteRetentionPolicy"
-                                                },
-                                                "description": "Optional. The service properties for soft delete."
-                                              },
-                                              "defaultValue": {
-                                                "enabled": true,
-                                                "days": 7
-                                              }
-                                            },
-                                            "corsRules": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/corsRuleType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                                              }
-                                            },
-                                            "diagnosticSettings": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/diagnosticSettingFullType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The diagnostic settings of the service."
-                                              }
-                                            },
-                                            "shares": {
-                                              "type": "array",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. File shares to create."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "enableReferencedModulesTelemetry": false
-                                          },
-                                          "resources": {
-                                            "storageAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.Storage/storageAccounts",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[parameters('storageAccountName')]"
-                                            },
-                                            "fileServices": {
-                                              "type": "Microsoft.Storage/storageAccounts/fileServices",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('name'))]",
-                                              "properties": {
-                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]",
-                                                "protocolSettings": "[parameters('protocolSettings')]",
-                                                "shareDeleteRetentionPolicy": "[parameters('shareDeleteRetentionPolicy')]"
-                                              }
-                                            },
-                                            "fileServices_diagnosticSettings": {
-                                              "copy": {
-                                                "name": "fileServices_diagnosticSettings",
-                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Insights/diagnosticSettings",
-                                              "apiVersion": "2021-05-01-preview",
-                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/fileServices/{1}', parameters('storageAccountName'), parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "metrics",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                                    "input": {
-                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                                      "timeGrain": null
-                                                    }
-                                                  },
-                                                  {
-                                                    "name": "logs",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                                    "input": {
-                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                                    }
-                                                  }
-                                                ],
-                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                              },
-                                              "dependsOn": [
-                                                "fileServices"
-                                              ]
-                                            },
-                                            "fileServices_shares": {
-                                              "copy": {
-                                                "name": "fileServices_shares",
-                                                "count": "[length(coalesce(parameters('shares'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-shares-{1}', deployment().name, copyIndex())]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "storageAccountName": {
-                                                    "value": "[parameters('storageAccountName')]"
-                                                  },
-                                                  "fileServicesName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "name": {
-                                                    "value": "[coalesce(parameters('shares'), createArray())[copyIndex()].name]"
-                                                  },
-                                                  "accessTier": {
-                                                    "value": "[coalesce(tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'accessTier'), if(equals(reference('storageAccount', '2024-01-01', 'full').kind, 'FileStorage'), 'Premium', 'TransactionOptimized'))]"
-                                                  },
-                                                  "enabledProtocols": {
-                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'enabledProtocols')]"
-                                                  },
-                                                  "rootSquash": {
-                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'rootSquash')]"
-                                                  },
-                                                  "shareQuota": {
-                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'shareQuota')]"
-                                                  },
-                                                  "roleAssignments": {
-                                                    "value": "[tryGet(coalesce(parameters('shares'), createArray())[copyIndex()], 'roleAssignments')]"
-                                                  },
-                                                  "enableTelemetry": {
-                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "15881640847294537074"
-                                                    },
-                                                    "name": "Storage Account File Shares",
-                                                    "description": "This module deploys a Storage Account File Share."
-                                                  },
-                                                  "definitions": {
-                                                    "roleAssignmentType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                          }
-                                                        },
-                                                        "roleDefinitionIdOrName": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                          }
-                                                        },
-                                                        "principalId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                          }
-                                                        },
-                                                        "principalType": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "Device",
-                                                            "ForeignGroup",
-                                                            "Group",
-                                                            "ServicePrincipal",
-                                                            "User"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The principal type of the assigned principal ID."
-                                                          }
-                                                        },
-                                                        "description": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The description of the role assignment."
-                                                          }
-                                                        },
-                                                        "condition": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                          }
-                                                        },
-                                                        "conditionVersion": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "2.0"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. Version of the condition."
-                                                          }
-                                                        },
-                                                        "delegatedManagedIdentityResourceId": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "description": "An AVM-aligned type for a role assignment.",
-                                                        "__bicep_imported_from!": {
-                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "storageAccountName": {
-                                                      "type": "string",
-                                                      "maxLength": 24,
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "fileServicesName": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent file service. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The name of the file share to create."
-                                                      }
-                                                    },
-                                                    "accessTier": {
-                                                      "type": "string",
-                                                      "defaultValue": "TransactionOptimized",
-                                                      "allowedValues": [
-                                                        "Premium",
-                                                        "Hot",
-                                                        "Cool",
-                                                        "TransactionOptimized"
-                                                      ],
-                                                      "metadata": {
-                                                        "description": "Conditional. Access tier for specific share. Required if the Storage Account kind is set to FileStorage (should be set to \"Premium\"). GpV2 account can choose between TransactionOptimized (default), Hot, and Cool."
-                                                      }
-                                                    },
-                                                    "shareQuota": {
-                                                      "type": "int",
-                                                      "defaultValue": 5120,
-                                                      "metadata": {
-                                                        "description": "Optional. The maximum size of the share, in gigabytes. Must be greater than 0, and less than or equal to 5120 (5TB). For Large File Shares, the maximum size is 102400 (100TB)."
-                                                      }
-                                                    },
-                                                    "enabledProtocols": {
-                                                      "type": "string",
-                                                      "defaultValue": "SMB",
-                                                      "allowedValues": [
-                                                        "NFS",
-                                                        "SMB"
-                                                      ],
-                                                      "metadata": {
-                                                        "description": "Optional. The authentication protocol that is used for the file share. Can only be specified when creating a share."
-                                                      }
-                                                    },
-                                                    "rootSquash": {
-                                                      "type": "string",
-                                                      "defaultValue": "NoRootSquash",
-                                                      "allowedValues": [
-                                                        "AllSquash",
-                                                        "NoRootSquash",
-                                                        "RootSquash"
-                                                      ],
-                                                      "metadata": {
-                                                        "description": "Optional. Permissions for NFS file shares are enforced by the client OS rather than the Azure Files service. Toggling the root squash behavior reduces the rights of the root user for NFS shares."
-                                                      }
-                                                    },
-                                                    "enableTelemetry": {
-                                                      "type": "bool",
-                                                      "defaultValue": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                                      }
-                                                    },
-                                                    "roleAssignments": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/roleAssignmentType"
-                                                      },
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Array of role assignments to create."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "formattedRoleAssignments",
-                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                                      }
-                                                    ],
-                                                    "builtInRoleNames": {
-                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                                      "Storage File Data SMB Share Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb')]",
-                                                      "Storage File Data SMB Share Elevated Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a7264617-510b-434b-a828-9731dc254ea7')]",
-                                                      "Storage File Data SMB Share Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'aba4ae5f-2193-4029-9191-0cb91df5e314')]",
-                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                                    }
-                                                  },
-                                                  "resources": {
-                                                    "storageAccount::fileService": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts/fileServices",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), parameters('fileServicesName'))]"
-                                                    },
-                                                    "avmTelemetry": {
-                                                      "condition": "[parameters('enableTelemetry')]",
-                                                      "type": "Microsoft.Resources/deployments",
-                                                      "apiVersion": "2024-03-01",
-                                                      "name": "[format('46d3xbcp.res.storage-fileshare.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                                      "properties": {
-                                                        "mode": "Incremental",
-                                                        "template": {
-                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                          "contentVersion": "1.0.0.0",
-                                                          "resources": [],
-                                                          "outputs": {
-                                                            "telemetry": {
-                                                              "type": "String",
-                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                            }
-                                                          }
-                                                        }
-                                                      }
-                                                    },
-                                                    "storageAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[parameters('storageAccountName')]"
-                                                    },
-                                                    "fileShare": {
-                                                      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "accessTier": "[parameters('accessTier')]",
-                                                        "shareQuota": "[parameters('shareQuota')]",
-                                                        "rootSquash": "[if(equals(parameters('enabledProtocols'), 'NFS'), parameters('rootSquash'), null())]",
-                                                        "enabledProtocols": "[parameters('enabledProtocols')]"
-                                                      }
-                                                    },
-                                                    "fileShare_roleAssignments": {
-                                                      "copy": {
-                                                        "name": "fileShare_roleAssignments",
-                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                                      },
-                                                      "type": "Microsoft.Resources/deployments",
-                                                      "apiVersion": "2022-09-01",
-                                                      "name": "[format('{0}-Share-Rbac-{1}', uniqueString(deployment().name), copyIndex())]",
-                                                      "properties": {
-                                                        "expressionEvaluationOptions": {
-                                                          "scope": "inner"
-                                                        },
-                                                        "mode": "Incremental",
-                                                        "parameters": {
-                                                          "scope": {
-                                                            "value": "[replace(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), '/shares/', '/fileshares/')]"
-                                                          },
-                                                          "name": {
-                                                            "value": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]"
-                                                          },
-                                                          "roleDefinitionId": {
-                                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
-                                                          },
-                                                          "principalId": {
-                                                            "value": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]"
-                                                          },
-                                                          "principalType": {
-                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]"
-                                                          },
-                                                          "condition": {
-                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]"
-                                                          },
-                                                          "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), createObject('value', coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0')), createObject('value', null()))]",
-                                                          "delegatedManagedIdentityResourceId": {
-                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                                          },
-                                                          "description": {
-                                                            "value": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]"
-                                                          }
-                                                        },
-                                                        "template": {
-                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                          "contentVersion": "1.0.0.0",
-                                                          "parameters": {
-                                                            "scope": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "Required. The scope to deploy the role assignment to."
-                                                              }
-                                                            },
-                                                            "name": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "Required. The name of the role assignment."
-                                                              }
-                                                            },
-                                                            "roleDefinitionId": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "Required. The role definition Id to assign."
-                                                              }
-                                                            },
-                                                            "principalId": {
-                                                              "type": "string",
-                                                              "metadata": {
-                                                                "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                              }
-                                                            },
-                                                            "principalType": {
-                                                              "type": "string",
-                                                              "allowedValues": [
-                                                                "Device",
-                                                                "ForeignGroup",
-                                                                "Group",
-                                                                "ServicePrincipal",
-                                                                "User",
-                                                                ""
-                                                              ],
-                                                              "defaultValue": "",
-                                                              "metadata": {
-                                                                "description": "Optional. The principal type of the assigned principal ID."
-                                                              }
-                                                            },
-                                                            "description": {
-                                                              "type": "string",
-                                                              "defaultValue": "",
-                                                              "metadata": {
-                                                                "description": "Optional. The description of the role assignment."
-                                                              }
-                                                            },
-                                                            "condition": {
-                                                              "type": "string",
-                                                              "defaultValue": "",
-                                                              "metadata": {
-                                                                "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\""
-                                                              }
-                                                            },
-                                                            "conditionVersion": {
-                                                              "type": "string",
-                                                              "allowedValues": [
-                                                                "2.0"
-                                                              ],
-                                                              "defaultValue": "2.0",
-                                                              "metadata": {
-                                                                "description": "Optional. Version of the condition."
-                                                              }
-                                                            },
-                                                            "delegatedManagedIdentityResourceId": {
-                                                              "type": "string",
-                                                              "defaultValue": "",
-                                                              "metadata": {
-                                                                "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                              }
-                                                            }
-                                                          },
-                                                          "resources": [
-                                                            {
-                                                              "type": "Microsoft.Authorization/roleAssignments",
-                                                              "apiVersion": "2022-04-01",
-                                                              "scope": "[parameters('scope')]",
-                                                              "name": "[parameters('name')]",
-                                                              "properties": {
-                                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                                                "principalId": "[parameters('principalId')]",
-                                                                "description": "[parameters('description')]",
-                                                                "principalType": "[if(not(empty(parameters('principalType'))), parameters('principalType'), null())]",
-                                                                "condition": "[if(not(empty(parameters('condition'))), parameters('condition'), null())]",
-                                                                "conditionVersion": "[if(and(not(empty(parameters('conditionVersion'))), not(empty(parameters('condition')))), parameters('conditionVersion'), null())]",
-                                                                "delegatedManagedIdentityResourceId": "[if(not(empty(parameters('delegatedManagedIdentityResourceId'))), parameters('delegatedManagedIdentityResourceId'), null())]"
-                                                              }
-                                                            }
-                                                          ]
-                                                        }
-                                                      },
-                                                      "dependsOn": [
-                                                        "fileShare"
-                                                      ]
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the deployed file share."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the deployed file share."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices/shares', parameters('storageAccountName'), parameters('fileServicesName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group of the deployed file share."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "fileServices",
-                                                "storageAccount"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed file share service."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed file share service."
-                                              },
-                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/fileServices', parameters('storageAccountName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group of the deployed file share service."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_queueServices": {
-                                      "condition": "[not(empty(parameters('queueServices')))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Storage-QueueServices', uniqueString(deployment().name, parameters('location')))]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "diagnosticSettings": {
-                                            "value": "[tryGet(parameters('queueServices'), 'diagnosticSettings')]"
-                                          },
-                                          "queues": {
-                                            "value": "[tryGet(parameters('queueServices'), 'queues')]"
-                                          },
-                                          "corsRules": {
-                                            "value": "[tryGet(parameters('queueServices'), 'corsRules')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "1100093319443502715"
-                                            },
-                                            "name": "Storage Account Queue Services",
-                                            "description": "This module deploys a Storage Account Queue Service."
-                                          },
-                                          "definitions": {
-                                            "corsRuleType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "allowedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                                  }
-                                                },
-                                                "allowedMethods": {
-                                                  "type": "array",
-                                                  "allowedValues": [
-                                                    "CONNECT",
-                                                    "DELETE",
-                                                    "GET",
-                                                    "HEAD",
-                                                    "MERGE",
-                                                    "OPTIONS",
-                                                    "PATCH",
-                                                    "POST",
-                                                    "PUT",
-                                                    "TRACE"
-                                                  ],
-                                                  "metadata": {
-                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                                  }
-                                                },
-                                                "allowedOrigins": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                                  }
-                                                },
-                                                "exposedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                                  }
-                                                },
-                                                "maxAgeInSeconds": {
-                                                  "type": "int",
-                                                  "metadata": {
-                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for a cors rule."
-                                              }
-                                            },
-                                            "diagnosticSettingFullType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the diagnostic setting."
-                                                  }
-                                                },
-                                                "logCategoriesAndGroups": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                        }
-                                                      },
-                                                      "categoryGroup": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                                  }
-                                                },
-                                                "metricCategories": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "metadata": {
-                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                                  }
-                                                },
-                                                "logAnalyticsDestinationType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "AzureDiagnostics",
-                                                    "Dedicated"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                                  }
-                                                },
-                                                "workspaceResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "storageAccountResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "eventHubAuthorizationRuleResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                                  }
-                                                },
-                                                "eventHubName": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "marketplacePartnerResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "queues": {
-                                              "type": "array",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Queues to create."
-                                              }
-                                            },
-                                            "corsRules": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/corsRuleType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                                              }
-                                            },
-                                            "diagnosticSettings": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/diagnosticSettingFullType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The diagnostic settings of the service."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "name": "default"
-                                          },
-                                          "resources": {
-                                            "storageAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.Storage/storageAccounts",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[parameters('storageAccountName')]"
-                                            },
-                                            "queueServices": {
-                                              "type": "Microsoft.Storage/storageAccounts/queueServices",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                                              "properties": {
-                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
-                                              }
-                                            },
-                                            "queueServices_diagnosticSettings": {
-                                              "copy": {
-                                                "name": "queueServices_diagnosticSettings",
-                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Insights/diagnosticSettings",
-                                              "apiVersion": "2021-05-01-preview",
-                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "metrics",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                                    "input": {
-                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                                      "timeGrain": null
-                                                    }
-                                                  },
-                                                  {
-                                                    "name": "logs",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                                    "input": {
-                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                                    }
-                                                  }
-                                                ],
-                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                              },
-                                              "dependsOn": [
-                                                "queueServices"
-                                              ]
-                                            },
-                                            "queueServices_queues": {
-                                              "copy": {
-                                                "name": "queueServices_queues",
-                                                "count": "[length(coalesce(parameters('queues'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-Queue-{1}', deployment().name, copyIndex())]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "storageAccountName": {
-                                                    "value": "[parameters('storageAccountName')]"
-                                                  },
-                                                  "name": {
-                                                    "value": "[coalesce(parameters('queues'), createArray())[copyIndex()].name]"
-                                                  },
-                                                  "metadata": {
-                                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'metadata')]"
-                                                  },
-                                                  "roleAssignments": {
-                                                    "value": "[tryGet(coalesce(parameters('queues'), createArray())[copyIndex()], 'roleAssignments')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "17963799770990303971"
-                                                    },
-                                                    "name": "Storage Account Queues",
-                                                    "description": "This module deploys a Storage Account Queue."
-                                                  },
-                                                  "definitions": {
-                                                    "roleAssignmentType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                          }
-                                                        },
-                                                        "roleDefinitionIdOrName": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                          }
-                                                        },
-                                                        "principalId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                          }
-                                                        },
-                                                        "principalType": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "Device",
-                                                            "ForeignGroup",
-                                                            "Group",
-                                                            "ServicePrincipal",
-                                                            "User"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The principal type of the assigned principal ID."
-                                                          }
-                                                        },
-                                                        "description": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The description of the role assignment."
-                                                          }
-                                                        },
-                                                        "condition": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                          }
-                                                        },
-                                                        "conditionVersion": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "2.0"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. Version of the condition."
-                                                          }
-                                                        },
-                                                        "delegatedManagedIdentityResourceId": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "description": "An AVM-aligned type for a role assignment.",
-                                                        "__bicep_imported_from!": {
-                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "storageAccountName": {
-                                                      "type": "string",
-                                                      "maxLength": 24,
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The name of the storage queue to deploy."
-                                                      }
-                                                    },
-                                                    "metadata": {
-                                                      "type": "object",
-                                                      "metadata": {
-                                                        "__bicep_resource_derived_type!": {
-                                                          "source": "Microsoft.Storage/storageAccounts/queueServices/queues@2024-01-01#properties/properties/properties/metadata"
-                                                        },
-                                                        "description": "Optional. A name-value pair that represents queue metadata."
-                                                      },
-                                                      "defaultValue": {}
-                                                    },
-                                                    "roleAssignments": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/roleAssignmentType"
-                                                      },
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Array of role assignments to create."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "formattedRoleAssignments",
-                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                                      }
-                                                    ],
-                                                    "builtInRoleNames": {
-                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                                      "Storage Queue Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
-                                                      "Storage Queue Data Message Processor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8a0f0c08-91a1-4084-bc3d-661d67233fed')]",
-                                                      "Storage Queue Data Message Sender": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c6a89b2d-59bc-44d0-9896-0f6e12d7b80a')]",
-                                                      "Storage Queue Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '19e7f393-937e-4f77-808e-94535e297925')]",
-                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                                    }
-                                                  },
-                                                  "resources": {
-                                                    "storageAccount::queueServices": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts/queueServices",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
-                                                    },
-                                                    "storageAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[parameters('storageAccountName')]"
-                                                    },
-                                                    "queue": {
-                                                      "type": "Microsoft.Storage/storageAccounts/queueServices/queues",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                                                      "properties": {
-                                                        "metadata": "[parameters('metadata')]"
-                                                      }
-                                                    },
-                                                    "queue_roleAssignments": {
-                                                      "copy": {
-                                                        "name": "queue_roleAssignments",
-                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                                      },
-                                                      "type": "Microsoft.Authorization/roleAssignments",
-                                                      "apiVersion": "2022-04-01",
-                                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/queueServices/{1}/queues/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                                      "properties": {
-                                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                                      },
-                                                      "dependsOn": [
-                                                        "queue"
-                                                      ]
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the deployed queue."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the deployed queue."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices/queues', parameters('storageAccountName'), 'default', parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group of the deployed queue."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed file share service."
-                                              },
-                                              "value": "[variables('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed file share service."
-                                              },
-                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/queueServices', parameters('storageAccountName'), variables('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group of the deployed file share service."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "storageAccount_tableServices": {
-                                      "condition": "[not(empty(parameters('tableServices')))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-Storage-TableServices', uniqueString(deployment().name, parameters('location')))]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "storageAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "diagnosticSettings": {
-                                            "value": "[tryGet(parameters('tableServices'), 'diagnosticSettings')]"
-                                          },
-                                          "tables": {
-                                            "value": "[tryGet(parameters('tableServices'), 'tables')]"
-                                          },
-                                          "corsRules": {
-                                            "value": "[tryGet(parameters('tableServices'), 'corsRules')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "13069389074590786512"
-                                            },
-                                            "name": "Storage Account Table Services",
-                                            "description": "This module deploys a Storage Account Table Service."
-                                          },
-                                          "definitions": {
-                                            "corsRuleType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "allowedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of headers allowed to be part of the cross-origin request."
-                                                  }
-                                                },
-                                                "allowedMethods": {
-                                                  "type": "array",
-                                                  "allowedValues": [
-                                                    "CONNECT",
-                                                    "DELETE",
-                                                    "GET",
-                                                    "HEAD",
-                                                    "MERGE",
-                                                    "OPTIONS",
-                                                    "PATCH",
-                                                    "POST",
-                                                    "PUT",
-                                                    "TRACE"
-                                                  ],
-                                                  "metadata": {
-                                                    "description": "Required. A list of HTTP methods that are allowed to be executed by the origin."
-                                                  }
-                                                },
-                                                "allowedOrigins": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of origin domains that will be allowed via CORS, or \"*\" to allow all domains."
-                                                  }
-                                                },
-                                                "exposedHeaders": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of response headers to expose to CORS clients."
-                                                  }
-                                                },
-                                                "maxAgeInSeconds": {
-                                                  "type": "int",
-                                                  "metadata": {
-                                                    "description": "Required. The number of seconds that the client/browser should cache a preflight response."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for a cors rule."
-                                              }
-                                            },
-                                            "diagnosticSettingFullType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the diagnostic setting."
-                                                  }
-                                                },
-                                                "logCategoriesAndGroups": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                        }
-                                                      },
-                                                      "categoryGroup": {
-                                                        "type": "string",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                                  }
-                                                },
-                                                "metricCategories": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "object",
-                                                    "properties": {
-                                                      "category": {
-                                                        "type": "string",
-                                                        "metadata": {
-                                                          "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                        }
-                                                      },
-                                                      "enabled": {
-                                                        "type": "bool",
-                                                        "nullable": true,
-                                                        "metadata": {
-                                                          "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                                  }
-                                                },
-                                                "logAnalyticsDestinationType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "AzureDiagnostics",
-                                                    "Dedicated"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                                  }
-                                                },
-                                                "workspaceResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "storageAccountResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "eventHubAuthorizationRuleResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                                  }
-                                                },
-                                                "eventHubName": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                                  }
-                                                },
-                                                "marketplacePartnerResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "storageAccountName": {
-                                              "type": "string",
-                                              "maxLength": 24,
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "tables": {
-                                              "type": "array",
-                                              "defaultValue": [],
-                                              "metadata": {
-                                                "description": "Optional. tables to create."
-                                              }
-                                            },
-                                            "corsRules": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/corsRuleType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The List of CORS rules. You can include up to five CorsRule elements in the request."
-                                              }
-                                            },
-                                            "diagnosticSettings": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/diagnosticSettingFullType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The diagnostic settings of the service."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "name": "default"
-                                          },
-                                          "resources": {
-                                            "storageAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.Storage/storageAccounts",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[parameters('storageAccountName')]"
-                                            },
-                                            "tableServices": {
-                                              "type": "Microsoft.Storage/storageAccounts/tableServices",
-                                              "apiVersion": "2024-01-01",
-                                              "name": "[format('{0}/{1}', parameters('storageAccountName'), variables('name'))]",
-                                              "properties": {
-                                                "cors": "[if(not(equals(parameters('corsRules'), null())), createObject('corsRules', parameters('corsRules')), null())]"
-                                              }
-                                            },
-                                            "tableServices_diagnosticSettings": {
-                                              "copy": {
-                                                "name": "tableServices_diagnosticSettings",
-                                                "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Insights/diagnosticSettings",
-                                              "apiVersion": "2021-05-01-preview",
-                                              "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}', parameters('storageAccountName'), variables('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', variables('name')))]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "metrics",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                                    "input": {
-                                                      "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                                      "timeGrain": null
-                                                    }
-                                                  },
-                                                  {
-                                                    "name": "logs",
-                                                    "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                                    "input": {
-                                                      "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                                      "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                                      "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                                    }
-                                                  }
-                                                ],
-                                                "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                                "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                                "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                                "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                                "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                                "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                              },
-                                              "dependsOn": [
-                                                "tableServices"
-                                              ]
-                                            },
-                                            "tableServices_tables": {
-                                              "copy": {
-                                                "name": "tableServices_tables",
-                                                "count": "[length(parameters('tables'))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-Table-{1}', deployment().name, copyIndex())]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[parameters('tables')[copyIndex()].name]"
-                                                  },
-                                                  "storageAccountName": {
-                                                    "value": "[parameters('storageAccountName')]"
-                                                  },
-                                                  "roleAssignments": {
-                                                    "value": "[tryGet(parameters('tables')[copyIndex()], 'roleAssignments')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "10905926757212375091"
-                                                    },
-                                                    "name": "Storage Account Table",
-                                                    "description": "This module deploys a Storage Account Table."
-                                                  },
-                                                  "definitions": {
-                                                    "roleAssignmentType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                          }
-                                                        },
-                                                        "roleDefinitionIdOrName": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                          }
-                                                        },
-                                                        "principalId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                          }
-                                                        },
-                                                        "principalType": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "Device",
-                                                            "ForeignGroup",
-                                                            "Group",
-                                                            "ServicePrincipal",
-                                                            "User"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The principal type of the assigned principal ID."
-                                                          }
-                                                        },
-                                                        "description": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The description of the role assignment."
-                                                          }
-                                                        },
-                                                        "condition": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                          }
-                                                        },
-                                                        "conditionVersion": {
-                                                          "type": "string",
-                                                          "allowedValues": [
-                                                            "2.0"
-                                                          ],
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. Version of the condition."
-                                                          }
-                                                        },
-                                                        "delegatedManagedIdentityResourceId": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "description": "An AVM-aligned type for a role assignment.",
-                                                        "__bicep_imported_from!": {
-                                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "storageAccountName": {
-                                                      "type": "string",
-                                                      "maxLength": 24,
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Storage Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "roleAssignments": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/roleAssignmentType"
-                                                      },
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Array of role assignments to create."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. Name of the table."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "formattedRoleAssignments",
-                                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                                      }
-                                                    ],
-                                                    "builtInRoleNames": {
-                                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                                      "Reader and Data Access": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'c12c1c16-33a1-487b-954d-41c89c60f349')]",
-                                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                                      "Storage Account Backup Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'e5e2a7ff-d759-4cd2-bb51-3152d37e2eb1')]",
-                                                      "Storage Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '17d1049b-9a84-46fb-8f53-869881c3d3ab')]",
-                                                      "Storage Account Key Operator Service Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '81a9662b-bebf-436f-a333-f67b29880f12')]",
-                                                      "Storage Table Data Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
-                                                      "Storage Table Data Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '76199698-9eea-4c19-bc75-cec21354c6b6')]",
-                                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                                    }
-                                                  },
-                                                  "resources": {
-                                                    "storageAccount::tableServices": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts/tableServices",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[format('{0}/{1}', parameters('storageAccountName'), 'default')]"
-                                                    },
-                                                    "storageAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Storage/storageAccounts",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[parameters('storageAccountName')]"
-                                                    },
-                                                    "table": {
-                                                      "type": "Microsoft.Storage/storageAccounts/tableServices/tables",
-                                                      "apiVersion": "2024-01-01",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('storageAccountName'), 'default', parameters('name'))]"
-                                                    },
-                                                    "table_roleAssignments": {
-                                                      "copy": {
-                                                        "name": "table_roleAssignments",
-                                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                                      },
-                                                      "type": "Microsoft.Authorization/roleAssignments",
-                                                      "apiVersion": "2022-04-01",
-                                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}/tableServices/{1}/tables/{2}', parameters('storageAccountName'), 'default', parameters('name'))]",
-                                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                                      "properties": {
-                                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                                      },
-                                                      "dependsOn": [
-                                                        "table"
-                                                      ]
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the deployed file share service."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the deployed file share service."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices/tables', parameters('storageAccountName'), 'default', parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group of the deployed file share service."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the deployed table service."
-                                              },
-                                              "value": "[variables('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the deployed table service."
-                                              },
-                                              "value": "[resourceId('Microsoft.Storage/storageAccounts/tableServices', parameters('storageAccountName'), variables('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group of the deployed table service."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    },
-                                    "secretsExport": {
-                                      "condition": "[not(equals(parameters('secretsExportConfiguration'), null()))]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-secrets-kv', uniqueString(deployment().name, parameters('location')))]",
-                                      "subscriptionId": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[2]]",
-                                      "resourceGroup": "[split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "keyVaultName": {
-                                            "value": "[last(split(tryGet(parameters('secretsExportConfiguration'), 'keyVaultResourceId'), '/'))]"
-                                          },
-                                          "secretsToSet": {
-                                            "value": "[union(createArray(), if(contains(parameters('secretsExportConfiguration'), 'accessKey1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey1Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[0].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString1Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString1Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage))), createArray()), if(contains(parameters('secretsExportConfiguration'), 'accessKey2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'accessKey2Name'), 'value', listKeys('storageAccount', '2024-01-01').keys[1].value)), createArray()), if(contains(parameters('secretsExportConfiguration'), 'connectionString2Name'), createArray(createObject('name', tryGet(parameters('secretsExportConfiguration'), 'connectionString2Name'), 'value', format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage))), createArray()))]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "9368972709899985618"
-                                            }
-                                          },
-                                          "definitions": {
-                                            "secretSetOutputType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "secretResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The resourceId of the exported secret."
-                                                  }
-                                                },
-                                                "secretUri": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The secret URI of the exported secret."
-                                                  }
-                                                },
-                                                "secretUriWithVersion": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "The secret URI with version of the exported secret."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for the output of the secret set via the secrets export feature.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                }
-                                              }
-                                            },
-                                            "secretToSetType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the secret to set."
-                                                  }
-                                                },
-                                                "value": {
-                                                  "type": "securestring",
-                                                  "metadata": {
-                                                    "description": "Required. The value of the secret to set."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for the secret to set via the secrets export feature.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "keyVaultName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The name of the Key Vault to set the ecrets in."
-                                              }
-                                            },
-                                            "secretsToSet": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/secretToSetType"
-                                              },
-                                              "metadata": {
-                                                "description": "Required. The secrets to set in the Key Vault."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "keyVault": {
-                                              "existing": true,
-                                              "type": "Microsoft.KeyVault/vaults",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[parameters('keyVaultName')]"
-                                            },
-                                            "secrets": {
-                                              "copy": {
-                                                "name": "secrets",
-                                                "count": "[length(parameters('secretsToSet'))]"
-                                              },
-                                              "type": "Microsoft.KeyVault/vaults/secrets",
-                                              "apiVersion": "2024-11-01",
-                                              "name": "[format('{0}/{1}', parameters('keyVaultName'), parameters('secretsToSet')[copyIndex()].name)]",
-                                              "properties": {
-                                                "value": "[parameters('secretsToSet')[copyIndex()].value]"
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "secretsSet": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/secretSetOutputType"
-                                              },
-                                              "metadata": {
-                                                "description": "The references to the secrets exported to the provided Key Vault."
-                                              },
-                                              "copy": {
-                                                "count": "[length(range(0, length(coalesce(parameters('secretsToSet'), createArray()))))]",
-                                                "input": {
-                                                  "secretResourceId": "[resourceId('Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), parameters('secretsToSet')[range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()]].name)]",
-                                                  "secretUri": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUri]",
-                                                  "secretUriWithVersion": "[reference(format('secrets[{0}]', range(0, length(coalesce(parameters('secretsToSet'), createArray())))[copyIndex()])).secretUriWithVersion]"
-                                                }
-                                              }
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "storageAccount"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the deployed storage account."
-                                      },
-                                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
-                                    },
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the deployed storage account."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource group of the deployed storage account."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    },
-                                    "primaryBlobEndpoint": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The primary blob endpoint reference if blob services are deployed."
-                                      },
-                                      "value": "[if(and(not(empty(parameters('blobServices'))), contains(parameters('blobServices'), 'containers')), reference(format('Microsoft.Storage/storageAccounts/{0}', parameters('name')), '2019-04-01').primaryEndpoints.blob, '')]"
-                                    },
-                                    "systemAssignedMIPrincipalId": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "The principal ID of the system assigned identity."
-                                      },
-                                      "value": "[tryGet(tryGet(reference('storageAccount', '2024-01-01', 'full'), 'identity'), 'principalId')]"
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The location the resource was deployed into."
-                                      },
-                                      "value": "[reference('storageAccount', '2024-01-01', 'full').location]"
-                                    },
-                                    "serviceEndpoints": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "description": "All service endpoints of the deployed storage account, Note Standard_LRS and Standard_ZRS accounts only have a blob service endpoint."
-                                      },
-                                      "value": "[reference('storageAccount').primaryEndpoints]"
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The private endpoints of the Storage Account."
-                                      },
-                                      "copy": {
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                                        "input": {
-                                          "name": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                                          "resourceId": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                                          "groupId": "[tryGet(tryGet(reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                                          "customDnsConfigs": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                                          "networkInterfaceResourceIds": "[reference(format('storageAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                                        }
-                                      }
-                                    },
-                                    "exportedSecrets": {
-                                      "$ref": "#/definitions/secretsOutputType",
-                                      "metadata": {
-                                        "description": "A hashtable of references to the secrets exported to the provided Key Vault. The key of each reference is each secret's name."
-                                      },
-                                      "value": "[if(not(equals(parameters('secretsExportConfiguration'), null())), toObject(reference('secretsExport').outputs.secretsSet.value, lambda('secret', last(split(lambdaVariables('secret').secretResourceId, '/'))), lambda('secret', lambdaVariables('secret'))), createObject())]"
-                                    },
-                                    "primaryAccessKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary access key of the storage account."
-                                      },
-                                      "value": "[listKeys('storageAccount', '2024-01-01').keys[0].value]"
-                                    },
-                                    "secondaryAccessKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondary access key of the storage account."
-                                      },
-                                      "value": "[listKeys('storageAccount', '2024-01-01').keys[1].value]"
-                                    },
-                                    "primaryConnectionString": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary connection string of the storage account."
-                                      },
-                                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[0].value, environment().suffixes.storage)]"
-                                    },
-                                    "secondaryConnectionString": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondary connection string of the storage account."
-                                      },
-                                      "value": "[format('DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1};EndpointSuffix={2}', parameters('name'), listKeys('storageAccount', '2024-01-01').keys[1].value, environment().suffixes.storage)]"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the Storage Account."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.name.value, variables('existingName'))]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource ID of the Storage Account."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('storageAccount').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.Storage/storageAccounts', variables('existingName')))]"
-                            },
-                            "subscriptionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Subscription ID of the Storage Account."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource Group Name of the Storage Account."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "aiSearch",
-                        "foundryAccount"
-                      ]
-                    },
-                    "cosmosDb": {
-                      "condition": "[parameters('includeAssociatedResources')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('module.cosmosDb.{0}', variables('resourcesName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "existingResourceId": {
-                            "value": "[tryGet(parameters('cosmosDbConfiguration'), 'existingResourceId')]"
-                          },
-                          "name": {
-                            "value": "[take(if(not(empty(tryGet(parameters('cosmosDbConfiguration'), 'name'))), parameters('cosmosDbConfiguration').name, format('cos{0}', variables('resourcesName'))), 44)]"
-                          },
-                          "location": {
-                            "value": "[parameters('location')]"
-                          },
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "enableTelemetry": {
-                            "value": "[parameters('enableTelemetry')]"
-                          },
-                          "privateEndpointSubnetResourceId": {
-                            "value": "[parameters('privateEndpointSubnetResourceId')]"
-                          },
-                          "privateDnsZoneResourceId": {
-                            "value": "[tryGet(parameters('cosmosDbConfiguration'), 'privateDnsZoneResourceId')]"
-                          },
-                          "roleAssignments": {
-                            "value": "[tryGet(parameters('cosmosDbConfiguration'), 'roleAssignments')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "12826689517691444097"
-                            }
-                          },
-                          "definitions": {
-                            "roleAssignmentType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                  }
-                                },
-                                "roleDefinitionIdOrName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                  }
-                                },
-                                "principalId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                  }
-                                },
-                                "principalType": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "Device",
-                                    "ForeignGroup",
-                                    "Group",
-                                    "ServicePrincipal",
-                                    "User"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The principal type of the assigned principal ID."
-                                  }
-                                },
-                                "description": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The description of the role assignment."
-                                  }
-                                },
-                                "condition": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                  }
-                                },
-                                "conditionVersion": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "2.0"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Version of the condition."
-                                  }
-                                },
-                                "delegatedManagedIdentityResourceId": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a role assignment.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "functions": [
-                            {
-                              "namespace": "__bicep",
-                              "members": {
-                                "getResourceGroupName": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 4), parameters('parts')[4], resourceGroup().name)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Group Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceName": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    },
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(and(and(not(empty(parameters('resourceId'))), contains(parameters('resourceId'), '/')), not(empty(parameters('parts')))), last(parameters('parts')), coalesce(parameters('resourceId'), ''))]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Resource Name from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getResourceParts": {
-                                  "parameters": [
-                                    {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "name": "resourceId"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "array",
-                                    "items": {
-                                      "type": "string"
-                                    },
-                                    "value": "[split(coalesce(parameters('resourceId'), ''), '/')]"
-                                  },
-                                  "metadata": {
-                                    "description": "Splits Resource ID into its components.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                },
-                                "getSubscriptionId": {
-                                  "parameters": [
-                                    {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "name": "parts"
-                                    }
-                                  ],
-                                  "output": {
-                                    "type": "string",
-                                    "value": "[if(greater(length(parameters('parts')), 2), parameters('parts')[2], subscription().subscriptionId)]"
-                                  },
-                                  "metadata": {
-                                    "description": "Extracts the Subscription ID from a Resource ID.",
-                                    "__bicep_imported_from!": {
-                                      "sourceTemplate": "parseResourceIdFunctions.bicep"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          ],
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "maxLength": 44,
-                              "metadata": {
-                                "description": "Required. The name of the Cosmos DB."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. The location for the Cosmos DB."
-                              }
-                            },
-                            "existingResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The full resource ID of an existing Cosmos DB to use instead of creating a new one."
-                              }
-                            },
-                            "privateEndpointSubnetResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Resource Id of an existing subnet to use for private connectivity. This is required along with 'privateDnsZoneResourceId' to establish private endpoints."
-                              }
-                            },
-                            "privateDnsZoneResourceId": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The resource ID of the private DNS zone for the Cosmos DB to establish private endpoints."
-                              }
-                            },
-                            "roleAssignments": {
-                              "type": "array",
-                              "items": {
-                                "$ref": "#/definitions/roleAssignmentType"
-                              },
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Specifies the role assignments for the Cosmos DB."
-                              }
-                            },
-                            "enableTelemetry": {
-                              "type": "bool",
-                              "defaultValue": true,
-                              "metadata": {
-                                "description": "Optional. Enable/Disable usage telemetry for module."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                                },
-                                "description": "Optional. Specifies the resource tags for all the resources."
-                              },
-                              "defaultValue": {}
-                            }
-                          },
-                          "variables": {
-                            "existingResourceParts": "[__bicep.getResourceParts(parameters('existingResourceId'))]",
-                            "existingName": "[__bicep.getResourceName(parameters('existingResourceId'), variables('existingResourceParts'))]",
-                            "existingSubscriptionId": "[__bicep.getSubscriptionId(variables('existingResourceParts'))]",
-                            "existingResourceGroupName": "[__bicep.getResourceGroupName(variables('existingResourceParts'))]",
-                            "privateNetworkingEnabled": "[and(not(empty(parameters('privateDnsZoneResourceId'))), not(empty(parameters('privateEndpointSubnetResourceId'))))]"
-                          },
-                          "resources": {
-                            "existingCosmosDb": {
-                              "condition": "[not(empty(parameters('existingResourceId')))]",
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2025-04-15",
-                              "subscriptionId": "[variables('existingSubscriptionId')]",
-                              "resourceGroup": "[variables('existingResourceGroupName')]",
-                              "name": "[variables('existingName')]"
-                            },
-                            "cosmosDb": {
-                              "condition": "[empty(parameters('existingResourceId'))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('avm.res.document-db.database-account.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[parameters('name')]"
-                                  },
-                                  "enableTelemetry": {
-                                    "value": "[parameters('enableTelemetry')]"
-                                  },
-                                  "automaticFailover": {
-                                    "value": true
-                                  },
-                                  "disableKeyBasedMetadataWriteAccess": {
-                                    "value": true
-                                  },
-                                  "disableLocalAuthentication": {
-                                    "value": true
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "minimumTlsVersion": {
-                                    "value": "Tls12"
-                                  },
-                                  "defaultConsistencyLevel": {
-                                    "value": "Session"
-                                  },
-                                  "networkRestrictions": {
-                                    "value": {
-                                      "networkAclBypass": "AzureServices",
-                                      "publicNetworkAccess": "[if(variables('privateNetworkingEnabled'), 'Disabled', 'Enabled')]"
-                                    }
-                                  },
-                                  "privateEndpoints": "[if(variables('privateNetworkingEnabled'), createObject('value', createArray(createObject('privateDnsZoneGroup', createObject('privateDnsZoneGroupConfigs', createArray(createObject('privateDnsZoneResourceId', parameters('privateDnsZoneResourceId')))), 'service', 'Sql', 'subnetResourceId', parameters('privateEndpointSubnetResourceId')))), createObject('value', createArray()))]",
-                                  "roleAssignments": {
-                                    "value": "[parameters('roleAssignments')]"
-                                  },
-                                  "tags": {
-                                    "value": "[parameters('tags')]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "languageVersion": "2.0",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.37.4.10188",
-                                      "templateHash": "17715929342484596741"
-                                    },
-                                    "name": "Azure Cosmos DB account",
-                                    "description": "This module deploys an Azure Cosmos DB account. The API used for the account is determined by the child resources that are deployed."
-                                  },
-                                  "definitions": {
-                                    "privateEndpointOutputType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The name of the private endpoint."
-                                          }
-                                        },
-                                        "resourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "The resource ID of the private endpoint."
-                                          }
-                                        },
-                                        "groupId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "The group ID for the private endpoint group."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "fqdn": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "fully-qualified domain name (FQDN) that resolves to private endpoint IP address."
-                                                }
-                                              },
-                                              "ipAddresses": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "string"
-                                                },
-                                                "metadata": {
-                                                  "description": "A list of private IP addresses for the private endpoint."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "The custom DNS configurations of the private endpoint."
-                                          }
-                                        },
-                                        "networkInterfaceResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "The IDs of the network interfaces associated with the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for the private endpoint output."
-                                      }
-                                    },
-                                    "failoverLocationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "failoverPriority": {
-                                          "type": "int",
-                                          "metadata": {
-                                            "description": "Required. The failover priority of the region. A failover priority of 0 indicates a write region. The maximum value for a failover priority = (total number of regions - 1). Failover priority values must be unique for each of the regions in which the database account exists."
-                                          }
-                                        },
-                                        "isZoneRedundant": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Flag to indicate whether or not this region is an AvailabilityZone region. Defaults to true."
-                                          }
-                                        },
-                                        "locationName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the region."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for the failover location."
-                                      }
-                                    },
-                                    "dataPlaneRoleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The unique name of the role assignment."
-                                          }
-                                        },
-                                        "roleDefinitionId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The unique identifier of the Azure Cosmos DB for NoSQL native role-based access control definition."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The unique identifier for the associated Microsoft Entra ID principal to which access is being granted through this role-based access control assignment. The tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for an Azure Cosmos DB for NoSQL native role-based access control assignment."
-                                      }
-                                    },
-                                    "dataPlaneRoleDefinitionType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The unique identifier of the role-based access control definition."
-                                          }
-                                        },
-                                        "roleName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. A user-friendly name for the role-based access control definition. This must be unique within the database account."
-                                          }
-                                        },
-                                        "dataActions": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. An array of data actions that are allowed."
-                                          }
-                                        },
-                                        "assignableScopes": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A set of fully-qualified scopes at or below which role-based access control assignments may be created using this definition. This setting allows application of this definition on the entire account or any underlying resource. This setting must have at least one element. Scopes higher than the account level are not enforceable as assignable scopes. Resources referenced in assignable scopes do not need to exist at creation. Defaults to the current account scope."
-                                          }
-                                        },
-                                        "assignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/sqlRoleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. An array of role-based access control assignments to be created for the definition."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for an Azure Cosmos DB for NoSQL or Table native role-based access control definition."
-                                      }
-                                    },
-                                    "sqlDatabaseType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Name of the database ."
-                                          }
-                                        },
-                                        "throughput": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Request units per second. Will be ignored if `autoscaleSettingsMaxThroughput` is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level. Defaults to 400."
-                                          }
-                                        },
-                                        "autoscaleSettingsMaxThroughput": {
-                                          "type": "int",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specifies the autoscale settings and represents maximum throughput the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If the value is not set, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                          }
-                                        },
-                                        "containers": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "name": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of the container."
-                                                }
-                                              },
-                                              "paths": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "string"
-                                                },
-                                                "minLength": 1,
-                                                "maxLength": 3,
-                                                "metadata": {
-                                                  "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                                                }
-                                              },
-                                              "analyticalStorageTtl": {
-                                                "type": "int",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                                                }
-                                              },
-                                              "autoscaleSettingsMaxThroughput": {
-                                                "type": "int",
-                                                "nullable": true,
-                                                "maxValue": 1000000,
-                                                "metadata": {
-                                                  "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level."
-                                                }
-                                              },
-                                              "conflictResolutionPolicy": {
-                                                "type": "object",
-                                                "properties": {
-                                                  "conflictResolutionPath": {
-                                                    "type": "string",
-                                                    "nullable": true,
-                                                    "metadata": {
-                                                      "description": "Conditional. The conflict resolution path in the case of LastWriterWins mode. Required if `mode` is set to 'LastWriterWins'."
-                                                    }
-                                                  },
-                                                  "conflictResolutionProcedure": {
-                                                    "type": "string",
-                                                    "nullable": true,
-                                                    "metadata": {
-                                                      "description": "Conditional. The procedure to resolve conflicts in the case of custom mode. Required if `mode` is set to 'Custom'."
-                                                    }
-                                                  },
-                                                  "mode": {
-                                                    "type": "string",
-                                                    "allowedValues": [
-                                                      "Custom",
-                                                      "LastWriterWins"
-                                                    ],
-                                                    "metadata": {
-                                                      "description": "Required. Indicates the conflict resolution mode."
-                                                    }
-                                                  }
-                                                },
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                                                }
-                                              },
-                                              "defaultTtl": {
-                                                "type": "int",
-                                                "nullable": true,
-                                                "minValue": -1,
-                                                "maxValue": 2147483647,
-                                                "metadata": {
-                                                  "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                                                }
-                                              },
-                                              "indexingPolicy": {
-                                                "type": "object",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Indexing policy of the container."
-                                                }
-                                              },
-                                              "kind": {
-                                                "type": "string",
-                                                "allowedValues": [
-                                                  "Hash",
-                                                  "MultiHash"
-                                                ],
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                                                }
-                                              },
-                                              "version": {
-                                                "type": "int",
-                                                "allowedValues": [
-                                                  1,
-                                                  2
-                                                ],
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                                                }
-                                              },
-                                              "throughput": {
-                                                "type": "int",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used."
-                                                }
-                                              },
-                                              "uniqueKeyPolicyKeys": {
-                                                "type": "array",
-                                                "items": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "paths": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "metadata": {
-                                                        "description": "Required. List of paths must be unique for each document in the Azure Cosmos DB service."
-                                                      }
-                                                    }
-                                                  }
-                                                },
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Set of containers to deploy in the database."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for an Azure Cosmos DB for NoSQL database."
-                                      }
-                                    },
-                                    "networkRestrictionType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "ipRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A single IPv4 address or a single IPv4 address range in Classless Inter-Domain Routing (CIDR) format. Provided IPs must be well-formatted and cannot be contained in one of the following ranges: `10.0.0.0/8`, `100.64.0.0/10`, `172.16.0.0/12`, `192.168.0.0/16`, since these are not enforceable by the IP address filter. Example of valid inputs: `23.40.210.245` or `23.40.210.0/8`."
-                                          }
-                                        },
-                                        "networkAclBypass": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureServices",
-                                            "None"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specifies the network ACL bypass for Azure services. Default to \"None\"."
-                                          }
-                                        },
-                                        "publicNetworkAccess": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Disabled",
-                                            "Enabled"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Whether requests from the public network are allowed. Default to \"Disabled\"."
-                                          }
-                                        },
-                                        "virtualNetworkRules": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "subnetResourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Resource ID of a subnet."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. List of virtual network access control list (ACL) rules configured for the account."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_export!": true,
-                                        "description": "The type for the network restriction."
-                                      }
-                                    },
-                                    "_1.privateEndpointCustomDnsConfigType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "fqdn": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                          }
-                                        },
-                                        "ipAddresses": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "metadata": {
-                                            "description": "Required. A list of private IP addresses of the private endpoint."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointIpConfigurationType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The name of the resource that is unique within a resource group."
-                                          }
-                                        },
-                                        "properties": {
-                                          "type": "object",
-                                          "properties": {
-                                            "groupId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "memberName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to."
-                                              }
-                                            },
-                                            "privateIPAddress": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. Properties of private endpoint IP configurations."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "_1.privateEndpointPrivateDnsZoneGroupType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the Private DNS Zone Group."
-                                          }
-                                        },
-                                        "privateDnsZoneGroupConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "name": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. The name of the private DNS Zone Group config."
-                                                }
-                                              },
-                                              "privateDnsZoneResourceId": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. The resource id of the private DNS zone."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "metadata": {
-                                            "description": "Required. The private DNS Zone Groups to associate the Private Endpoint. A DNS Zone Group can support up to 5 DNS zones."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "diagnosticSettingFullType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the diagnostic setting."
-                                          }
-                                        },
-                                        "logCategoriesAndGroups": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here."
-                                                }
-                                              },
-                                              "categoryGroup": {
-                                                "type": "string",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to `allLogs` to collect all logs."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of logs that will be streamed. \"allLogs\" includes all possible logs for the resource. Set to `[]` to disable log collection."
-                                          }
-                                        },
-                                        "metricCategories": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "object",
-                                            "properties": {
-                                              "category": {
-                                                "type": "string",
-                                                "metadata": {
-                                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                                }
-                                              },
-                                              "enabled": {
-                                                "type": "bool",
-                                                "nullable": true,
-                                                "metadata": {
-                                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                                          }
-                                        },
-                                        "logAnalyticsDestinationType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "AzureDiagnostics",
-                                            "Dedicated"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                                          }
-                                        },
-                                        "workspaceResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "storageAccountResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "eventHubAuthorizationRuleResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                                          }
-                                        },
-                                        "eventHubName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                                          }
-                                        },
-                                        "marketplacePartnerResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a diagnostic setting. To be used if both logs & metrics are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "lockType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the name of lock."
-                                          }
-                                        },
-                                        "kind": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "CanNotDelete",
-                                            "None",
-                                            "ReadOnly"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "notes": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the notes of the lock."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a lock.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "managedIdentityAllType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "systemAssigned": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enables system assigned managed identity on the resource."
-                                          }
-                                        },
-                                        "userAssignedResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "privateEndpointMultiServiceType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private endpoint."
-                                          }
-                                        },
-                                        "location": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The location to deploy the private endpoint to."
-                                          }
-                                        },
-                                        "privateLinkServiceConnectionName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name of the private link connection to create."
-                                          }
-                                        },
-                                        "service": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The subresource to deploy the private endpoint for. For example \"blob\", \"table\", \"queue\" or \"file\" for a Storage Account's Private Endpoints."
-                                          }
-                                        },
-                                        "subnetResourceId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                          }
-                                        },
-                                        "resourceGroupResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The resource ID of the Resource Group the Private Endpoint will be created in. If not specified, the Resource Group of the provided Virtual Network Subnet is used."
-                                          }
-                                        },
-                                        "privateDnsZoneGroup": {
-                                          "$ref": "#/definitions/_1.privateEndpointPrivateDnsZoneGroupType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                          }
-                                        },
-                                        "isManualConnection": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. If Manual Private Link Connection is required."
-                                          }
-                                        },
-                                        "manualConnectionRequestMessage": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "maxLength": 140,
-                                          "metadata": {
-                                            "description": "Optional. A message passed to the owner of the remote resource with the manual connection request."
-                                          }
-                                        },
-                                        "customDnsConfigs": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.privateEndpointCustomDnsConfigType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Custom DNS configurations."
-                                          }
-                                        },
-                                        "ipConfigurations": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/_1.privateEndpointIpConfigurationType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                          }
-                                        },
-                                        "applicationSecurityGroupResourceIds": {
-                                          "type": "array",
-                                          "items": {
-                                            "type": "string"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                          }
-                                        },
-                                        "customNetworkInterfaceName": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                          }
-                                        },
-                                        "lock": {
-                                          "$ref": "#/definitions/lockType",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Specify the type of lock."
-                                          }
-                                        },
-                                        "roleAssignments": {
-                                          "type": "array",
-                                          "items": {
-                                            "$ref": "#/definitions/roleAssignmentType"
-                                          },
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Array of role assignments to create."
-                                          }
-                                        },
-                                        "tags": {
-                                          "type": "object",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "__bicep_resource_derived_type!": {
-                                              "source": "Microsoft.Network/privateEndpoints@2024-07-01#properties/tags"
-                                            },
-                                            "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                          }
-                                        },
-                                        "enableTelemetry": {
-                                          "type": "bool",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Enable/Disable usage telemetry for module."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a private endpoint. To be used if the private endpoint's default service / groupId can NOT be assumed (i.e., for services that have more than one subresource, like Storage Account with Blob (blob, table, queue, file, ...).",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "roleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                          }
-                                        },
-                                        "roleDefinitionIdOrName": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                          }
-                                        },
-                                        "principalType": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "Device",
-                                            "ForeignGroup",
-                                            "Group",
-                                            "ServicePrincipal",
-                                            "User"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The principal type of the assigned principal ID."
-                                          }
-                                        },
-                                        "description": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The description of the role assignment."
-                                          }
-                                        },
-                                        "condition": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                          }
-                                        },
-                                        "conditionVersion": {
-                                          "type": "string",
-                                          "allowedValues": [
-                                            "2.0"
-                                          ],
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Version of the condition."
-                                          }
-                                        },
-                                        "delegatedManagedIdentityResourceId": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "An AVM-aligned type for a role assignment.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.1"
-                                        }
-                                      }
-                                    },
-                                    "sqlRoleAssignmentType": {
-                                      "type": "object",
-                                      "properties": {
-                                        "name": {
-                                          "type": "string",
-                                          "nullable": true,
-                                          "metadata": {
-                                            "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                                          }
-                                        },
-                                        "principalId": {
-                                          "type": "string",
-                                          "metadata": {
-                                            "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                          }
-                                        }
-                                      },
-                                      "metadata": {
-                                        "description": "The type for the SQL Role Assignments.",
-                                        "__bicep_imported_from!": {
-                                          "sourceTemplate": "sql-role-definition/main.bicep"
-                                        }
-                                      }
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the account."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "defaultValue": "[resourceGroup().location]",
-                                      "metadata": {
-                                        "description": "Optional. Defaults to the current resource group scope location. Location for all resources."
-                                      }
-                                    },
-                                    "tags": {
-                                      "type": "object",
-                                      "metadata": {
-                                        "__bicep_resource_derived_type!": {
-                                          "source": "Microsoft.DocumentDB/databaseAccounts@2024-11-15#properties/tags"
-                                        },
-                                        "description": "Optional. Tags for the resource."
-                                      },
-                                      "nullable": true
-                                    },
-                                    "managedIdentities": {
-                                      "$ref": "#/definitions/managedIdentityAllType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The managed identity definition for this resource."
-                                      }
-                                    },
-                                    "databaseAccountOfferType": {
-                                      "type": "string",
-                                      "defaultValue": "Standard",
-                                      "allowedValues": [
-                                        "Standard"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. The offer type for the account. Defaults to \"Standard\"."
-                                      }
-                                    },
-                                    "failoverLocations": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/failoverLocationType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The set of locations enabled for the account. Defaults to the location where the account is deployed."
-                                      }
-                                    },
-                                    "zoneRedundant": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Indicates whether the single-region account is zone redundant. Defaults to true. This property is ignored for multi-region accounts."
-                                      }
-                                    },
-                                    "defaultConsistencyLevel": {
-                                      "type": "string",
-                                      "defaultValue": "Session",
-                                      "allowedValues": [
-                                        "Eventual",
-                                        "ConsistentPrefix",
-                                        "Session",
-                                        "BoundedStaleness",
-                                        "Strong"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. The default consistency level of the account. Defaults to \"Session\"."
-                                      }
-                                    },
-                                    "disableLocalAuthentication": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Opt-out of local authentication and ensure that only Microsoft Entra can be used exclusively for authentication. Defaults to true."
-                                      }
-                                    },
-                                    "enableAnalyticalStorage": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Flag to indicate whether to enable storage analytics. Defaults to false."
-                                      }
-                                    },
-                                    "automaticFailover": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable automatic failover for regions. Defaults to true."
-                                      }
-                                    },
-                                    "enableFreeTier": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Flag to indicate whether \"Free Tier\" is enabled. Defaults to false."
-                                      }
-                                    },
-                                    "enableMultipleWriteLocations": {
-                                      "type": "bool",
-                                      "defaultValue": false,
-                                      "metadata": {
-                                        "description": "Optional. Enables the account to write in multiple locations. Periodic backup must be used if enabled. Defaults to false."
-                                      }
-                                    },
-                                    "disableKeyBasedMetadataWriteAccess": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Disable write operations on metadata resources (databases, containers, throughput) via account keys. Defaults to true."
-                                      }
-                                    },
-                                    "maxStalenessPrefix": {
-                                      "type": "int",
-                                      "defaultValue": 100000,
-                                      "minValue": 1,
-                                      "maxValue": 2147483647,
-                                      "metadata": {
-                                        "description": "Optional. The maximum stale requests. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 10 to 1000000. Multi Region: 100000 to 1000000. Defaults to 100000."
-                                      }
-                                    },
-                                    "maxIntervalInSeconds": {
-                                      "type": "int",
-                                      "defaultValue": 300,
-                                      "minValue": 5,
-                                      "maxValue": 86400,
-                                      "metadata": {
-                                        "description": "Optional. The maximum lag time in minutes. Required for \"BoundedStaleness\" consistency level. Valid ranges, Single Region: 5 to 84600. Multi Region: 300 to 86400. Defaults to 300."
-                                      }
-                                    },
-                                    "serverVersion": {
-                                      "type": "string",
-                                      "defaultValue": "4.2",
-                                      "allowedValues": [
-                                        "3.2",
-                                        "3.6",
-                                        "4.0",
-                                        "4.2",
-                                        "5.0",
-                                        "6.0",
-                                        "7.0"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Specifies the MongoDB server version to use if using Azure Cosmos DB for MongoDB RU. Defaults to \"4.2\"."
-                                      }
-                                    },
-                                    "sqlDatabases": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/sqlDatabaseType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for NoSQL."
-                                      }
-                                    },
-                                    "mongodbDatabases": {
-                                      "type": "array",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for MongoDB RU."
-                                      }
-                                    },
-                                    "gremlinDatabases": {
-                                      "type": "array",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Apache Gremlin."
-                                      }
-                                    },
-                                    "tables": {
-                                      "type": "array",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration for databases when using Azure Cosmos DB for Table."
-                                      }
-                                    },
-                                    "enableTelemetry": {
-                                      "type": "bool",
-                                      "defaultValue": true,
-                                      "metadata": {
-                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                      }
-                                    },
-                                    "totalThroughputLimit": {
-                                      "type": "int",
-                                      "defaultValue": -1,
-                                      "metadata": {
-                                        "description": "Optional. The total throughput limit imposed on this account in request units per second (RU/s). Default to unlimited throughput."
-                                      }
-                                    },
-                                    "lock": {
-                                      "$ref": "#/definitions/lockType",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The lock settings of the service."
-                                      }
-                                    },
-                                    "roleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/roleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. An array of control plane Azure role-based access control assignments."
-                                      }
-                                    },
-                                    "dataPlaneRoleDefinitions": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/dataPlaneRoleDefinitionType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control definitions. Allows the creations of custom role definitions."
-                                      }
-                                    },
-                                    "dataPlaneRoleAssignments": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/dataPlaneRoleAssignmentType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configurations for Azure Cosmos DB for NoSQL native role-based access control assignments."
-                                      }
-                                    },
-                                    "diagnosticSettings": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/diagnosticSettingFullType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. The diagnostic settings for the service."
-                                      }
-                                    },
-                                    "capabilitiesToAdd": {
-                                      "type": "array",
-                                      "items": {
-                                        "type": "string"
-                                      },
-                                      "nullable": true,
-                                      "allowedValues": [
-                                        "EnableCassandra",
-                                        "EnableTable",
-                                        "EnableGremlin",
-                                        "EnableMongo",
-                                        "DisableRateLimitingResponses",
-                                        "EnableServerless",
-                                        "EnableNoSQLVectorSearch",
-                                        "EnableNoSQLFullTextSearch",
-                                        "EnableMaterializedViews",
-                                        "DeleteAllItemsByPartitionKey"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. A list of Azure Cosmos DB specific capabilities for the account."
-                                      }
-                                    },
-                                    "backupPolicyType": {
-                                      "type": "string",
-                                      "defaultValue": "Continuous",
-                                      "allowedValues": [
-                                        "Periodic",
-                                        "Continuous"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Configures the backup mode. Periodic backup must be used if multiple write locations are used. Defaults to \"Continuous\"."
-                                      }
-                                    },
-                                    "backupPolicyContinuousTier": {
-                                      "type": "string",
-                                      "defaultValue": "Continuous30Days",
-                                      "allowedValues": [
-                                        "Continuous30Days",
-                                        "Continuous7Days"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Configuration values to specify the retention period for continuous mode backup. Default to \"Continuous30Days\"."
-                                      }
-                                    },
-                                    "backupIntervalInMinutes": {
-                                      "type": "int",
-                                      "defaultValue": 240,
-                                      "minValue": 60,
-                                      "maxValue": 1440,
-                                      "metadata": {
-                                        "description": "Optional. An integer representing the interval in minutes between two backups. This setting only applies to the periodic backup type. Defaults to 240."
-                                      }
-                                    },
-                                    "backupRetentionIntervalInHours": {
-                                      "type": "int",
-                                      "defaultValue": 8,
-                                      "minValue": 2,
-                                      "maxValue": 720,
-                                      "metadata": {
-                                        "description": "Optional. An integer representing the time (in hours) that each backup is retained. This setting only applies to the periodic backup type. Defaults to 8."
-                                      }
-                                    },
-                                    "backupStorageRedundancy": {
-                                      "type": "string",
-                                      "defaultValue": "Local",
-                                      "allowedValues": [
-                                        "Geo",
-                                        "Local",
-                                        "Zone"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Setting that indicates the type of backup residency. This setting only applies to the periodic backup type. Defaults to \"Local\"."
-                                      }
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointMultiServiceType"
-                                      },
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "Optional. Configuration details for private endpoints. For security reasons, it is advised to use private endpoints whenever possible."
-                                      }
-                                    },
-                                    "networkRestrictions": {
-                                      "$ref": "#/definitions/networkRestrictionType",
-                                      "defaultValue": {
-                                        "ipRules": [],
-                                        "virtualNetworkRules": [],
-                                        "publicNetworkAccess": "Disabled"
-                                      },
-                                      "metadata": {
-                                        "description": "Optional. The network configuration of this module. Defaults to `{ ipRules: [], virtualNetworkRules: [], publicNetworkAccess: 'Disabled' }`."
-                                      }
-                                    },
-                                    "minimumTlsVersion": {
-                                      "type": "string",
-                                      "defaultValue": "Tls12",
-                                      "allowedValues": [
-                                        "Tls12"
-                                      ],
-                                      "metadata": {
-                                        "description": "Optional. Setting that indicates the minimum allowed TLS version. Azure Cosmos DB for MongoDB RU and Apache Cassandra only work with TLS 1.2 or later. Defaults to \"Tls12\" (TLS 1.2)."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "copy": [
-                                      {
-                                        "name": "formattedRoleAssignments",
-                                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInControlPlaneRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                      }
-                                    ],
-                                    "enableReferencedModulesTelemetry": false,
-                                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', null())), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                                    "builtInControlPlaneRoleNames": {
-                                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                      "Cosmos DB Account Reader Role": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'fbdf93bf-df7d-467e-a4d2-9458aa1360c8')]",
-                                      "Cosmos DB Operator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
-                                      "CosmosBackupOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'db7b14f2-5adf-42da-9f96-f2ee17bab5cb')]",
-                                      "CosmosRestoreOperator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5432c526-bc82-444a-b7ba-57c5b0b5b34f')]",
-                                      "DocumentDB Account Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '5bd9cd88-fe45-4216-938b-f97437e15450')]",
-                                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                                    }
-                                  },
-                                  "resources": {
-                                    "avmTelemetry": {
-                                      "condition": "[parameters('enableTelemetry')]",
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2024-07-01",
-                                      "name": "[format('46d3xbcp.res.documentdb-databaseaccount.{0}.{1}', replace('0.16.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                      "properties": {
-                                        "mode": "Incremental",
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "contentVersion": "1.0.0.0",
-                                          "resources": [],
-                                          "outputs": {
-                                            "telemetry": {
-                                              "type": "String",
-                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                            }
-                                          }
-                                        }
-                                      }
-                                    },
-                                    "databaseAccount": {
-                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                      "apiVersion": "2024-11-15",
-                                      "name": "[parameters('name')]",
-                                      "location": "[parameters('location')]",
-                                      "tags": "[parameters('tags')]",
-                                      "identity": "[variables('identity')]",
-                                      "kind": "[if(not(empty(parameters('mongodbDatabases'))), 'MongoDB', 'GlobalDocumentDB')]",
-                                      "properties": "[shallowMerge(createArray(createObject('databaseAccountOfferType', parameters('databaseAccountOfferType'), 'backupPolicy', shallowMerge(createArray(createObject('type', parameters('backupPolicyType')), if(equals(parameters('backupPolicyType'), 'Continuous'), createObject('continuousModeProperties', createObject('tier', parameters('backupPolicyContinuousTier'))), createObject()), if(equals(parameters('backupPolicyType'), 'Periodic'), createObject('periodicModeProperties', createObject('backupIntervalInMinutes', parameters('backupIntervalInMinutes'), 'backupRetentionIntervalInHours', parameters('backupRetentionIntervalInHours'), 'backupStorageRedundancy', parameters('backupStorageRedundancy'))), createObject()))), 'capabilities', map(coalesce(parameters('capabilitiesToAdd'), createArray()), lambda('capability', createObject('name', lambdaVariables('capability')))), 'minimalTlsVersion', parameters('minimumTlsVersion'), 'capacity', createObject('totalThroughputLimit', parameters('totalThroughputLimit')), 'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Disabled')), if(or(or(or(not(empty(parameters('sqlDatabases'))), not(empty(parameters('mongodbDatabases')))), not(empty(parameters('gremlinDatabases')))), not(empty(parameters('tables')))), createObject('consistencyPolicy', shallowMerge(createArray(createObject('defaultConsistencyLevel', parameters('defaultConsistencyLevel')), if(equals(parameters('defaultConsistencyLevel'), 'BoundedStaleness'), createObject('maxStalenessPrefix', parameters('maxStalenessPrefix'), 'maxIntervalInSeconds', parameters('maxIntervalInSeconds')), createObject()))), 'enableMultipleWriteLocations', parameters('enableMultipleWriteLocations'), 'locations', if(not(empty(parameters('failoverLocations'))), map(parameters('failoverLocations'), lambda('failoverLocation', createObject('failoverPriority', lambdaVariables('failoverLocation').failoverPriority, 'locationName', lambdaVariables('failoverLocation').locationName, 'isZoneRedundant', coalesce(tryGet(lambdaVariables('failoverLocation'), 'isZoneRedundant'), true())))), createArray(createObject('failoverPriority', 0, 'locationName', parameters('location'), 'isZoneRedundant', parameters('zoneRedundant')))), 'ipRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'ipRules'), createArray()), lambda('ipRule', createObject('ipAddressOrRange', lambdaVariables('ipRule')))), 'virtualNetworkRules', map(coalesce(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules'), createArray()), lambda('rule', createObject('id', lambdaVariables('rule').subnetResourceId, 'ignoreMissingVNetServiceEndpoint', false()))), 'networkAclBypass', coalesce(tryGet(parameters('networkRestrictions'), 'networkAclBypass'), 'None'), 'isVirtualNetworkFilterEnabled', or(not(empty(tryGet(parameters('networkRestrictions'), 'ipRules'))), not(empty(tryGet(parameters('networkRestrictions'), 'virtualNetworkRules')))), 'enableFreeTier', parameters('enableFreeTier'), 'enableAutomaticFailover', parameters('automaticFailover'), 'enableAnalyticalStorage', parameters('enableAnalyticalStorage')), createObject()), if(or(not(empty(parameters('mongodbDatabases'))), not(empty(parameters('gremlinDatabases')))), createObject('disableLocalAuth', false(), 'disableKeyBasedMetadataWriteAccess', false()), createObject('disableLocalAuth', parameters('disableLocalAuthentication'), 'disableKeyBasedMetadataWriteAccess', parameters('disableKeyBasedMetadataWriteAccess'))), if(not(empty(parameters('mongodbDatabases'))), createObject('apiProperties', createObject('serverVersion', parameters('serverVersion'))), createObject())))]"
-                                    },
-                                    "databaseAccount_lock": {
-                                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                      "type": "Microsoft.Authorization/locks",
-                                      "apiVersion": "2020-05-01",
-                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                      "properties": {
-                                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_diagnosticSettings": {
-                                      "copy": {
-                                        "name": "databaseAccount_diagnosticSettings",
-                                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Insights/diagnosticSettings",
-                                      "apiVersion": "2021-05-01-preview",
-                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                                      "properties": {
-                                        "copy": [
-                                          {
-                                            "name": "metrics",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                                            "input": {
-                                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                                              "timeGrain": null
-                                            }
-                                          },
-                                          {
-                                            "name": "logs",
-                                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs'))))]",
-                                            "input": {
-                                              "categoryGroup": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'categoryGroup')]",
-                                              "category": "[tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'category')]",
-                                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logCategoriesAndGroups'), createArray(createObject('categoryGroup', 'allLogs')))[copyIndex('logs')], 'enabled'), true())]"
-                                            }
-                                          }
-                                        ],
-                                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_roleAssignments": {
-                                      "copy": {
-                                        "name": "databaseAccount_roleAssignments",
-                                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('name'))]",
-                                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                      "properties": {
-                                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_sqlDatabases": {
-                                      "copy": {
-                                        "name": "databaseAccount_sqlDatabases",
-                                        "count": "[length(coalesce(parameters('sqlDatabases'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name)]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(parameters('sqlDatabases'), createArray())[copyIndex()].name]"
-                                          },
-                                          "containers": {
-                                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'containers')]"
-                                          },
-                                          "throughput": {
-                                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'throughput')]"
-                                          },
-                                          "databaseAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "autoscaleSettingsMaxThroughput": {
-                                            "value": "[tryGet(coalesce(parameters('sqlDatabases'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "7141543733238879531"
-                                            },
-                                            "name": "DocumentDB Database Account SQL Databases",
-                                            "description": "This module deploys a SQL Database in a CosmosDB Account."
-                                          },
-                                          "parameters": {
-                                            "databaseAccountName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the SQL database ."
-                                              }
-                                            },
-                                            "containers": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "object"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of containers to deploy in the SQL database."
-                                              }
-                                            },
-                                            "throughput": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Request units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                              }
-                                            },
-                                            "autoscaleSettingsMaxThroughput": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. Setting throughput at the database level is only recommended for development/test or when workload across all containers in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags of the SQL database resource."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "databaseAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[parameters('databaseAccountName')]"
-                                            },
-                                            "sqlDatabase": {
-                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "resource": {
-                                                  "id": "[parameters('name')]"
-                                                },
-                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(equals(parameters('autoscaleSettingsMaxThroughput'), null()), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
-                                              },
-                                              "dependsOn": [
-                                                "databaseAccount"
-                                              ]
-                                            },
-                                            "container": {
-                                              "copy": {
-                                                "name": "container",
-                                                "count": "[length(coalesce(parameters('containers'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-sqldb-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('containers'), createArray())[copyIndex()].name)]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "databaseAccountName": {
-                                                    "value": "[parameters('databaseAccountName')]"
-                                                  },
-                                                  "sqlDatabaseName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "name": {
-                                                    "value": "[coalesce(parameters('containers'), createArray())[copyIndex()].name]"
-                                                  },
-                                                  "analyticalStorageTtl": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'analyticalStorageTtl')]"
-                                                  },
-                                                  "autoscaleSettingsMaxThroughput": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'autoscaleSettingsMaxThroughput')]"
-                                                  },
-                                                  "conflictResolutionPolicy": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'conflictResolutionPolicy')]"
-                                                  },
-                                                  "defaultTtl": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'defaultTtl')]"
-                                                  },
-                                                  "indexingPolicy": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'indexingPolicy')]"
-                                                  },
-                                                  "kind": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'kind')]"
-                                                  },
-                                                  "version": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'version')]"
-                                                  },
-                                                  "paths": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'paths')]"
-                                                  },
-                                                  "throughput": "[if(and(or(not(equals(parameters('throughput'), null())), not(equals(parameters('autoscaleSettingsMaxThroughput'), null()))), equals(tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput'), null())), createObject('value', -1), createObject('value', tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'throughput')))]",
-                                                  "uniqueKeyPolicyKeys": {
-                                                    "value": "[tryGet(coalesce(parameters('containers'), createArray())[copyIndex()], 'uniqueKeyPolicyKeys')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "1789954443166349986"
-                                                    },
-                                                    "name": "DocumentDB Database Account SQL Database Containers",
-                                                    "description": "This module deploys a SQL Database Container in a CosmosDB Account."
-                                                  },
-                                                  "parameters": {
-                                                    "databaseAccountName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "sqlDatabaseName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent SQL Database. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. Name of the container."
-                                                      }
-                                                    },
-                                                    "analyticalStorageTtl": {
-                                                      "type": "int",
-                                                      "defaultValue": 0,
-                                                      "metadata": {
-                                                        "description": "Optional. Default to 0. Indicates how long data should be retained in the analytical store, for a container. Analytical store is enabled when ATTL is set with a value other than 0. If the value is set to -1, the analytical store retains all historical data, irrespective of the retention of the data in the transactional store."
-                                                      }
-                                                    },
-                                                    "conflictResolutionPolicy": {
-                                                      "type": "object",
-                                                      "defaultValue": {},
-                                                      "metadata": {
-                                                        "description": "Optional. The conflict resolution policy for the container. Conflicts and conflict resolution policies are applicable if the Azure Cosmos DB account is configured with multiple write regions."
-                                                      }
-                                                    },
-                                                    "defaultTtl": {
-                                                      "type": "int",
-                                                      "defaultValue": -1,
-                                                      "minValue": -1,
-                                                      "maxValue": 2147483647,
-                                                      "metadata": {
-                                                        "description": "Optional. Default to -1. Default time to live (in seconds). With Time to Live or TTL, Azure Cosmos DB provides the ability to delete items automatically from a container after a certain time period. If the value is set to \"-1\", it is equal to infinity, and items don't expire by default."
-                                                      }
-                                                    },
-                                                    "throughput": {
-                                                      "type": "int",
-                                                      "defaultValue": 400,
-                                                      "metadata": {
-                                                        "description": "Optional. Default to 400. Request Units per second. Will be ignored if autoscaleSettingsMaxThroughput is used. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                                      }
-                                                    },
-                                                    "autoscaleSettingsMaxThroughput": {
-                                                      "type": "int",
-                                                      "nullable": true,
-                                                      "maxValue": 1000000,
-                                                      "metadata": {
-                                                        "description": "Optional. Specifies the Autoscale settings and represents maximum throughput, the resource can scale up to. The autoscale throughput should have valid throughput values between 1000 and 1000000 inclusive in increments of 1000. If value is set to null, then autoscale will be disabled. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the container level and not at the database level."
-                                                      }
-                                                    },
-                                                    "tags": {
-                                                      "type": "object",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Tags of the SQL Database resource."
-                                                      }
-                                                    },
-                                                    "paths": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "minLength": 1,
-                                                      "maxLength": 3,
-                                                      "metadata": {
-                                                        "description": "Required. List of paths using which data within the container can be partitioned. For kind=MultiHash it can be up to 3. For anything else it needs to be exactly 1."
-                                                      }
-                                                    },
-                                                    "indexingPolicy": {
-                                                      "type": "object",
-                                                      "defaultValue": {},
-                                                      "metadata": {
-                                                        "description": "Optional. Indexing policy of the container."
-                                                      }
-                                                    },
-                                                    "uniqueKeyPolicyKeys": {
-                                                      "type": "array",
-                                                      "defaultValue": [],
-                                                      "metadata": {
-                                                        "description": "Optional. The unique key policy configuration containing a list of unique keys that enforces uniqueness constraint on documents in the collection in the Azure Cosmos DB service."
-                                                      }
-                                                    },
-                                                    "kind": {
-                                                      "type": "string",
-                                                      "defaultValue": "Hash",
-                                                      "allowedValues": [
-                                                        "Hash",
-                                                        "MultiHash"
-                                                      ],
-                                                      "metadata": {
-                                                        "description": "Optional. Default to Hash. Indicates the kind of algorithm used for partitioning."
-                                                      }
-                                                    },
-                                                    "version": {
-                                                      "type": "int",
-                                                      "defaultValue": 1,
-                                                      "allowedValues": [
-                                                        1,
-                                                        2
-                                                      ],
-                                                      "metadata": {
-                                                        "description": "Optional. Default to 1 for Hash and 2 for MultiHash - 1 is not allowed for MultiHash. Version of the partition key definition."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "partitionKeyPaths",
-                                                        "count": "[length(parameters('paths'))]",
-                                                        "input": "[if(startsWith(parameters('paths')[copyIndex('partitionKeyPaths')], '/'), parameters('paths')[copyIndex('partitionKeyPaths')], format('/{0}', parameters('paths')[copyIndex('partitionKeyPaths')]))]"
-                                                      }
-                                                    ],
-                                                    "containerResourceParams": "[union(createObject('conflictResolutionPolicy', parameters('conflictResolutionPolicy'), 'defaultTtl', parameters('defaultTtl'), 'id', parameters('name'), 'indexingPolicy', if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null()), 'partitionKey', createObject('paths', variables('partitionKeyPaths'), 'kind', parameters('kind'), 'version', if(equals(parameters('kind'), 'MultiHash'), 2, parameters('version'))), 'uniqueKeyPolicy', if(not(empty(parameters('uniqueKeyPolicyKeys'))), createObject('uniqueKeys', parameters('uniqueKeyPolicyKeys')), null())), if(not(equals(parameters('analyticalStorageTtl'), 0)), createObject('analyticalStorageTtl', parameters('analyticalStorageTtl')), createObject()))]"
-                                                  },
-                                                  "resources": {
-                                                    "databaseAccount::sqlDatabase": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('sqlDatabaseName'))]"
-                                                    },
-                                                    "databaseAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[parameters('databaseAccountName')]"
-                                                    },
-                                                    "container": {
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]",
-                                                      "tags": "[parameters('tags')]",
-                                                      "properties": {
-                                                        "resource": "[variables('containerResourceParams')]",
-                                                        "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', if(and(equals(parameters('autoscaleSettingsMaxThroughput'), null()), not(equals(parameters('throughput'), -1))), parameters('throughput'), null()), 'autoscaleSettings', if(not(equals(parameters('autoscaleSettingsMaxThroughput'), null())), createObject('maxThroughput', parameters('autoscaleSettingsMaxThroughput')), null())))]"
-                                                      },
-                                                      "dependsOn": [
-                                                        "databaseAccount"
-                                                      ]
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the container."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the container."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases/containers', parameters('databaseAccountName'), parameters('sqlDatabaseName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the resource group the container was created in."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "sqlDatabase"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the SQL database."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the SQL database."
-                                              },
-                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the SQL database was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_sqlRoleDefinitions": {
-                                      "copy": {
-                                        "name": "databaseAccount_sqlRoleDefinitions",
-                                        "count": "[length(coalesce(parameters('dataPlaneRoleDefinitions'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-sqlrd-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "databaseAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "name": {
-                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'name')]"
-                                          },
-                                          "dataActions": {
-                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'dataActions')]"
-                                          },
-                                          "roleName": {
-                                            "value": "[coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()].roleName]"
-                                          },
-                                          "assignableScopes": {
-                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignableScopes')]"
-                                          },
-                                          "sqlRoleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleDefinitions'), createArray())[copyIndex()], 'assignments')]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "9570871897890815068"
-                                            },
-                                            "name": "DocumentDB Database Account SQL Role Definitions.",
-                                            "description": "This module deploys a SQL Role Definision in a CosmosDB Account."
-                                          },
-                                          "definitions": {
-                                            "sqlRoleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true,
-                                                "description": "The type for the SQL Role Assignments."
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "databaseAccountName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The unique identifier of the Role Definition."
-                                              }
-                                            },
-                                            "roleName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. A user-friendly name for the Role Definition. Must be unique for the database account."
-                                              }
-                                            },
-                                            "dataActions": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "defaultValue": [],
-                                              "metadata": {
-                                                "description": "Optional. An array of data actions that are allowed."
-                                              }
-                                            },
-                                            "assignableScopes": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. A set of fully qualified Scopes at or below which Role Assignments may be created using this Role Definition. This will allow application of this Role Definition on the entire database account or any underlying Database / Collection. Must have at least one element. Scopes higher than Database account are not enforceable as assignable Scopes. Note that resources referenced in assignable Scopes need not exist. Defaults to the current account."
-                                              }
-                                            },
-                                            "sqlRoleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/sqlRoleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. An array of SQL Role Assignments to be created for the SQL Role Definition."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "enableReferencedModulesTelemetry": false
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroledefinition.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "databaseAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[parameters('databaseAccountName')]"
-                                            },
-                                            "sqlRoleDefinition": {
-                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]",
-                                              "properties": {
-                                                "assignableScopes": "[coalesce(parameters('assignableScopes'), createArray(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]",
-                                                "permissions": [
-                                                  {
-                                                    "dataActions": "[parameters('dataActions')]"
-                                                  }
-                                                ],
-                                                "roleName": "[parameters('roleName')]",
-                                                "type": "CustomRole"
-                                              }
-                                            },
-                                            "databaseAccount_sqlRoleAssignments": {
-                                              "copy": {
-                                                "name": "databaseAccount_sqlRoleAssignments",
-                                                "count": "[length(coalesce(parameters('sqlRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "databaseAccountName": {
-                                                    "value": "[parameters('databaseAccountName')]"
-                                                  },
-                                                  "roleDefinitionId": {
-                                                    "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
-                                                  },
-                                                  "principalId": {
-                                                    "value": "[coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()].principalId]"
-                                                  },
-                                                  "name": {
-                                                    "value": "[tryGet(coalesce(parameters('sqlRoleAssignments'), createArray())[copyIndex()], 'name')]"
-                                                  },
-                                                  "enableTelemetry": {
-                                                    "value": "[variables('enableReferencedModulesTelemetry')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "10102303164433641479"
-                                                    },
-                                                    "name": "DocumentDB Database Account SQL Role Assignments.",
-                                                    "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
-                                                  },
-                                                  "parameters": {
-                                                    "databaseAccountName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                                                      }
-                                                    },
-                                                    "principalId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                                      }
-                                                    },
-                                                    "roleDefinitionId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The unique identifier of the associated SQL Role Definition."
-                                                      }
-                                                    },
-                                                    "enableTelemetry": {
-                                                      "type": "bool",
-                                                      "defaultValue": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Enable/Disable usage telemetry for module."
-                                                      }
-                                                    }
-                                                  },
-                                                  "resources": {
-                                                    "avmTelemetry": {
-                                                      "condition": "[parameters('enableTelemetry')]",
-                                                      "type": "Microsoft.Resources/deployments",
-                                                      "apiVersion": "2024-03-01",
-                                                      "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                                      "properties": {
-                                                        "mode": "Incremental",
-                                                        "template": {
-                                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                          "contentVersion": "1.0.0.0",
-                                                          "resources": [],
-                                                          "outputs": {
-                                                            "telemetry": {
-                                                              "type": "String",
-                                                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                            }
-                                                          }
-                                                        }
-                                                      }
-                                                    },
-                                                    "databaseAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[parameters('databaseAccountName')]"
-                                                    },
-                                                    "sqlRoleAssignment": {
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
-                                                      "properties": {
-                                                        "principalId": "[parameters('principalId')]",
-                                                        "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                                        "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the SQL Role Assignment."
-                                                      },
-                                                      "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the SQL Role Assignment."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the resource group the SQL Role Definition was created in."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "sqlRoleDefinition"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the SQL Role Definition."
-                                              },
-                                              "value": "[coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role'))]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the SQL Role Definition."
-                                              },
-                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('databaseAccountName'), coalesce(parameters('name'), guid(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), parameters('databaseAccountName'), 'sql-role')))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the SQL Role Definition was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "roleName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The role name of the SQL Role Definition."
-                                              },
-                                              "value": "[reference('sqlRoleDefinition').roleName]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_sqlRoleAssignments": {
-                                      "copy": {
-                                        "name": "databaseAccount_sqlRoleAssignments",
-                                        "count": "[length(coalesce(parameters('dataPlaneRoleAssignments'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-sqlra-{1}', uniqueString(deployment().name), copyIndex())]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "databaseAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "roleDefinitionId": {
-                                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]"
-                                          },
-                                          "principalId": {
-                                            "value": "[coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()].principalId]"
-                                          },
-                                          "name": {
-                                            "value": "[tryGet(coalesce(parameters('dataPlaneRoleAssignments'), createArray())[copyIndex()], 'name')]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "10102303164433641479"
-                                            },
-                                            "name": "DocumentDB Database Account SQL Role Assignments.",
-                                            "description": "This module deploys a SQL Role Assignment in a CosmosDB Account."
-                                          },
-                                          "parameters": {
-                                            "databaseAccountName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Name unique identifier of the SQL Role Assignment."
-                                              }
-                                            },
-                                            "principalId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The unique identifier for the associated AAD principal in the AAD graph to which access is being granted through this Role Assignment. Tenant ID for the principal is inferred using the tenant associated with the subscription."
-                                              }
-                                            },
-                                            "roleDefinitionId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. The unique identifier of the associated SQL Role Definition."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.doctdb-dbacct-sqlroleassignment.{0}.{1}', replace('-..--..-', '.', '-'), substring(uniqueString(deployment().name), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "databaseAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[parameters('databaseAccountName')]"
-                                            },
-                                            "sqlRoleAssignment": {
-                                              "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]",
-                                              "properties": {
-                                                "principalId": "[parameters('principalId')]",
-                                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
-                                                "scope": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))]"
-                                              }
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the SQL Role Assignment."
-                                              },
-                                              "value": "[coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName'))))]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the SQL Role Assignment."
-                                              },
-                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments', parameters('databaseAccountName'), coalesce(parameters('name'), guid(parameters('roleDefinitionId'), parameters('principalId'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')))))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the SQL Role Definition was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_mongodbDatabases": {
-                                      "copy": {
-                                        "name": "databaseAccount_mongodbDatabases",
-                                        "count": "[length(coalesce(parameters('mongodbDatabases'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-mongodb-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name)]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "databaseAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "name": {
-                                            "value": "[coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()].name]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "collections": {
-                                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'collections')]"
-                                          },
-                                          "throughput": {
-                                            "value": "[tryGet(coalesce(parameters('mongodbDatabases'), createArray())[copyIndex()], 'throughput')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "9160691107424630312"
-                                            },
-                                            "name": "DocumentDB Database Account MongoDB Databases",
-                                            "description": "This module deploys a MongoDB Database within a CosmosDB Account."
-                                          },
-                                          "parameters": {
-                                            "databaseAccountName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the mongodb database."
-                                              }
-                                            },
-                                            "throughput": {
-                                              "type": "int",
-                                              "defaultValue": 400,
-                                              "metadata": {
-                                                "description": "Optional. Request Units per second. Setting throughput at the database level is only recommended for development/test or when workload across all collections in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
-                                              }
-                                            },
-                                            "collections": {
-                                              "type": "array",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Collections in the mongodb database."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags of the resource."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "databaseAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[parameters('databaseAccountName')]"
-                                            },
-                                            "mongodbDatabase": {
-                                              "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "resource": {
-                                                  "id": "[parameters('name')]"
-                                                },
-                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]"
-                                              },
-                                              "dependsOn": [
-                                                "databaseAccount"
-                                              ]
-                                            },
-                                            "mongodbDatabase_collections": {
-                                              "copy": {
-                                                "name": "mongodbDatabase_collections",
-                                                "count": "[length(coalesce(parameters('collections'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-collection-{1}', uniqueString(deployment().name, parameters('name')), coalesce(parameters('collections'), createArray())[copyIndex()].name)]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "databaseAccountName": {
-                                                    "value": "[parameters('databaseAccountName')]"
-                                                  },
-                                                  "mongodbDatabaseName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "name": {
-                                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].name]"
-                                                  },
-                                                  "indexes": {
-                                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].indexes]"
-                                                  },
-                                                  "shardKey": {
-                                                    "value": "[coalesce(parameters('collections'), createArray())[copyIndex()].shardKey]"
-                                                  },
-                                                  "throughput": {
-                                                    "value": "[tryGet(coalesce(parameters('collections'), createArray())[copyIndex()], 'throughput')]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "14050805189442830205"
-                                                    },
-                                                    "name": "DocumentDB Database Account MongoDB Database Collections",
-                                                    "description": "This module deploys a MongoDB Database Collection."
-                                                  },
-                                                  "parameters": {
-                                                    "databaseAccountName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Cosmos DB database account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "mongodbDatabaseName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent mongodb database. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. Name of the collection."
-                                                      }
-                                                    },
-                                                    "throughput": {
-                                                      "type": "int",
-                                                      "defaultValue": 400,
-                                                      "metadata": {
-                                                        "description": "Optional. Request Units per second. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the collection level and not at the database level."
-                                                      }
-                                                    },
-                                                    "indexes": {
-                                                      "type": "array",
-                                                      "metadata": {
-                                                        "description": "Required. Indexes for the collection."
-                                                      }
-                                                    },
-                                                    "shardKey": {
-                                                      "type": "object",
-                                                      "metadata": {
-                                                        "description": "Required. ShardKey for the collection."
-                                                      }
-                                                    }
-                                                  },
-                                                  "resources": [
-                                                    {
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "options": "[if(contains(reference(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('databaseAccountName')), '2024-11-15').capabilities, createObject('name', 'EnableServerless')), null(), createObject('throughput', parameters('throughput')))]",
-                                                        "resource": {
-                                                          "id": "[parameters('name')]",
-                                                          "indexes": "[parameters('indexes')]",
-                                                          "shardKey": "[parameters('shardKey')]"
-                                                        }
-                                                      }
-                                                    }
-                                                  ],
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the mongodb database collection."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the mongodb database collection."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases/collections', parameters('databaseAccountName'), parameters('mongodbDatabaseName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the resource group the mongodb database collection was created in."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "mongodbDatabase"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the mongodb database."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the mongodb database."
-                                              },
-                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/mongodbDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the mongodb database was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_gremlinDatabases": {
-                                      "copy": {
-                                        "name": "databaseAccount_gremlinDatabases",
-                                        "count": "[length(coalesce(parameters('gremlinDatabases'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-gremlin-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name)]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "databaseAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "name": {
-                                            "value": "[coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()].name]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "graphs": {
-                                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'graphs')]"
-                                          },
-                                          "maxThroughput": {
-                                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'maxThroughput')]"
-                                          },
-                                          "throughput": {
-                                            "value": "[tryGet(coalesce(parameters('gremlinDatabases'), createArray())[copyIndex()], 'throughput')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "16834580070429190924"
-                                            },
-                                            "name": "DocumentDB Database Account Gremlin Databases",
-                                            "description": "This module deploys a Gremlin Database within a CosmosDB Account."
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the Gremlin database."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags of the Gremlin database resource."
-                                              }
-                                            },
-                                            "databaseAccountName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Gremlin database. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "graphs": {
-                                              "type": "array",
-                                              "defaultValue": [],
-                                              "metadata": {
-                                                "description": "Optional. Array of graphs to deploy in the Gremlin database."
-                                              }
-                                            },
-                                            "maxThroughput": {
-                                              "type": "int",
-                                              "defaultValue": 4000,
-                                              "metadata": {
-                                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
-                                              }
-                                            },
-                                            "throughput": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`. Setting throughput at the database level is only recommended for development/test or when workload across all graphs in the shared throughput database is uniform. For best performance for large production workloads, it is recommended to set dedicated throughput (autoscale or manual) at the graph level and not at the database level."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "databaseAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[parameters('databaseAccountName')]"
-                                            },
-                                            "gremlinDatabase": {
-                                              "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
-                                                "resource": {
-                                                  "id": "[parameters('name')]"
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "databaseAccount"
-                                              ]
-                                            },
-                                            "gremlinDatabase_gremlinGraphs": {
-                                              "copy": {
-                                                "name": "gremlinDatabase_gremlinGraphs",
-                                                "count": "[length(parameters('graphs'))]"
-                                              },
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-gremlindb-{1}', uniqueString(deployment().name, parameters('name')), parameters('graphs')[copyIndex()].name)]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[parameters('graphs')[copyIndex()].name]"
-                                                  },
-                                                  "gremlinDatabaseName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "databaseAccountName": {
-                                                    "value": "[parameters('databaseAccountName')]"
-                                                  },
-                                                  "indexingPolicy": {
-                                                    "value": "[tryGet(parameters('graphs')[copyIndex()], 'indexingPolicy')]"
-                                                  },
-                                                  "partitionKeyPaths": "[if(not(empty(parameters('graphs')[copyIndex()].partitionKeyPaths)), createObject('value', parameters('graphs')[copyIndex()].partitionKeyPaths), createObject('value', createArray()))]"
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.37.4.10188",
-                                                      "templateHash": "15062578211366932944"
-                                                    },
-                                                    "name": "DocumentDB Database Accounts Gremlin Databases Graphs",
-                                                    "description": "This module deploys a DocumentDB Database Accounts Gremlin Database Graph."
-                                                  },
-                                                  "parameters": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. Name of the graph."
-                                                      }
-                                                    },
-                                                    "tags": {
-                                                      "type": "object",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. Tags of the Gremlin graph resource."
-                                                      }
-                                                    },
-                                                    "databaseAccountName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Database Account. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "gremlinDatabaseName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent Gremlin Database. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "indexingPolicy": {
-                                                      "type": "object",
-                                                      "defaultValue": {},
-                                                      "metadata": {
-                                                        "description": "Optional. Indexing policy of the graph."
-                                                      }
-                                                    },
-                                                    "partitionKeyPaths": {
-                                                      "type": "array",
-                                                      "defaultValue": [],
-                                                      "metadata": {
-                                                        "description": "Optional. List of paths using which data within the container can be partitioned."
-                                                      }
-                                                    }
-                                                  },
-                                                  "resources": {
-                                                    "databaseAccount::gremlinDatabase": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'))]"
-                                                    },
-                                                    "databaseAccount": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[parameters('databaseAccountName')]"
-                                                    },
-                                                    "gremlinGraph": {
-                                                      "type": "Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs",
-                                                      "apiVersion": "2024-11-15",
-                                                      "name": "[format('{0}/{1}/{2}', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]",
-                                                      "tags": "[parameters('tags')]",
-                                                      "properties": {
-                                                        "resource": {
-                                                          "id": "[parameters('name')]",
-                                                          "indexingPolicy": "[if(not(empty(parameters('indexingPolicy'))), parameters('indexingPolicy'), null())]",
-                                                          "partitionKey": {
-                                                            "paths": "[if(not(empty(parameters('partitionKeyPaths'))), parameters('partitionKeyPaths'), null())]"
-                                                          }
-                                                        }
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the graph."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the graph."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases/graphs', parameters('databaseAccountName'), parameters('gremlinDatabaseName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the resource group the graph was created in."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "gremlinDatabase"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the Gremlin database."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the Gremlin database."
-                                              },
-                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/gremlinDatabases', parameters('databaseAccountName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the Gremlin database was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_tables": {
-                                      "copy": {
-                                        "name": "databaseAccount_tables",
-                                        "count": "[length(coalesce(parameters('tables'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-table-{1}', uniqueString(deployment().name, parameters('location')), coalesce(parameters('tables'), createArray())[copyIndex()].name)]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "databaseAccountName": {
-                                            "value": "[parameters('name')]"
-                                          },
-                                          "name": {
-                                            "value": "[coalesce(parameters('tables'), createArray())[copyIndex()].name]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "maxThroughput": {
-                                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'maxThroughput')]"
-                                          },
-                                          "throughput": {
-                                            "value": "[tryGet(coalesce(parameters('tables'), createArray())[copyIndex()], 'throughput')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.37.4.10188",
-                                              "templateHash": "3429971823201332257"
-                                            },
-                                            "name": "Azure Cosmos DB account tables",
-                                            "description": "This module deploys a table within an Azure Cosmos DB Account."
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the table."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags for the table."
-                                              }
-                                            },
-                                            "databaseAccountName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Conditional. The name of the parent Azure Cosmos DB account. Required if the template is used in a standalone deployment."
-                                              }
-                                            },
-                                            "maxThroughput": {
-                                              "type": "int",
-                                              "defaultValue": 4000,
-                                              "metadata": {
-                                                "description": "Optional. Represents maximum throughput, the resource can scale up to. Cannot be set together with `throughput`. If `throughput` is set to something else than -1, this autoscale setting is ignored."
-                                              }
-                                            },
-                                            "throughput": {
-                                              "type": "int",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Request Units per second (for example 10000). Cannot be set together with `maxThroughput`."
-                                              }
-                                            }
-                                          },
-                                          "resources": {
-                                            "databaseAccount": {
-                                              "existing": true,
-                                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[parameters('databaseAccountName')]"
-                                            },
-                                            "table": {
-                                              "type": "Microsoft.DocumentDB/databaseAccounts/tables",
-                                              "apiVersion": "2024-11-15",
-                                              "name": "[format('{0}/{1}', parameters('databaseAccountName'), parameters('name'))]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "options": "[if(contains(reference('databaseAccount').capabilities, createObject('name', 'EnableServerless')), createObject(), createObject('autoscaleSettings', if(equals(parameters('throughput'), null()), createObject('maxThroughput', parameters('maxThroughput')), null()), 'throughput', parameters('throughput')))]",
-                                                "resource": {
-                                                  "id": "[parameters('name')]"
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "databaseAccount"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the table."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the table."
-                                              },
-                                              "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts/tables', parameters('databaseAccountName'), parameters('name'))]"
-                                            },
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the resource group the table was created in."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    },
-                                    "databaseAccount_privateEndpoints": {
-                                      "copy": {
-                                        "name": "databaseAccount_privateEndpoints",
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]"
-                                      },
-                                      "type": "Microsoft.Resources/deployments",
-                                      "apiVersion": "2022-09-01",
-                                      "name": "[format('{0}-dbAccount-PrivateEndpoint-{1}', uniqueString(deployment().name, parameters('location')), copyIndex())]",
-                                      "subscriptionId": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[2]]",
-                                      "resourceGroup": "[split(coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'resourceGroupResourceId'), resourceGroup().id), '/')[4]]",
-                                      "properties": {
-                                        "expressionEvaluationOptions": {
-                                          "scope": "inner"
-                                        },
-                                        "mode": "Incremental",
-                                        "parameters": {
-                                          "name": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'name'), format('pep-{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex()))]"
-                                          },
-                                          "privateLinkServiceConnections": "[if(not(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true())), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service))))), createObject('value', null()))]",
-                                          "manualPrivateLinkServiceConnections": "[if(equals(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'isManualConnection'), true()), createObject('value', createArray(createObject('name', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateLinkServiceConnectionName'), format('{0}-{1}-{2}', last(split(resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), '/')), coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service, copyIndex())), 'properties', createObject('privateLinkServiceId', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name')), 'groupIds', createArray(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].service), 'requestMessage', coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'manualConnectionRequestMessage'), 'Manual approval required.'))))), createObject('value', null()))]",
-                                          "subnetResourceId": {
-                                            "value": "[coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId]"
-                                          },
-                                          "enableTelemetry": {
-                                            "value": "[variables('enableReferencedModulesTelemetry')]"
-                                          },
-                                          "location": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'location'), reference(split(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()].subnetResourceId, '/subnets/')[0], '2020-06-01', 'Full').location)]"
-                                          },
-                                          "lock": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'lock'), parameters('lock'))]"
-                                          },
-                                          "privateDnsZoneGroup": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'privateDnsZoneGroup')]"
-                                          },
-                                          "roleAssignments": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'roleAssignments')]"
-                                          },
-                                          "tags": {
-                                            "value": "[coalesce(tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'tags'), parameters('tags'))]"
-                                          },
-                                          "customDnsConfigs": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customDnsConfigs')]"
-                                          },
-                                          "ipConfigurations": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'ipConfigurations')]"
-                                          },
-                                          "applicationSecurityGroupResourceIds": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'applicationSecurityGroupResourceIds')]"
-                                          },
-                                          "customNetworkInterfaceName": {
-                                            "value": "[tryGet(coalesce(parameters('privateEndpoints'), createArray())[copyIndex()], 'customNetworkInterfaceName')]"
-                                          }
-                                        },
-                                        "template": {
-                                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                          "languageVersion": "2.0",
-                                          "contentVersion": "1.0.0.0",
-                                          "metadata": {
-                                            "_generator": {
-                                              "name": "bicep",
-                                              "version": "0.34.44.8038",
-                                              "templateHash": "12389807800450456797"
-                                            },
-                                            "name": "Private Endpoints",
-                                            "description": "This module deploys a Private Endpoint."
-                                          },
-                                          "definitions": {
-                                            "privateDnsZoneGroupType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the Private DNS Zone Group."
-                                                  }
-                                                },
-                                                "privateDnsZoneGroupConfigs": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. The private DNS zone groups to associate the private endpoint. A DNS zone group can support up to 5 DNS zones."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "ipConfigurationType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the resource that is unique within a resource group."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "memberName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string."
-                                                      }
-                                                    },
-                                                    "privateIPAddress": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. A private IP address obtained from the private endpoint's subnet."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private endpoint IP configurations."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "privateLinkServiceConnectionType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The name of the private link service connection."
-                                                  }
-                                                },
-                                                "properties": {
-                                                  "type": "object",
-                                                  "properties": {
-                                                    "groupIds": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "type": "string"
-                                                      },
-                                                      "metadata": {
-                                                        "description": "Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. If used with private link service connection, this property must be defined as empty string array `[]`."
-                                                      }
-                                                    },
-                                                    "privateLinkServiceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Required. The resource id of private link service."
-                                                      }
-                                                    },
-                                                    "requestMessage": {
-                                                      "type": "string",
-                                                      "nullable": true,
-                                                      "metadata": {
-                                                        "description": "Optional. A message passed to the owner of the remote resource with this connection request. Restricted to 140 chars."
-                                                      }
-                                                    }
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. Properties of private link service connection."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "customDnsConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "fqdn": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. FQDN that resolves to private endpoint IP address."
-                                                  }
-                                                },
-                                                "ipAddresses": {
-                                                  "type": "array",
-                                                  "items": {
-                                                    "type": "string"
-                                                  },
-                                                  "metadata": {
-                                                    "description": "Required. A list of private IP addresses of the private endpoint."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_export!": true
-                                              }
-                                            },
-                                            "lockType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the name of lock."
-                                                  }
-                                                },
-                                                "kind": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "CanNotDelete",
-                                                    "None",
-                                                    "ReadOnly"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Specify the type of lock."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a lock.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            },
-                                            "privateDnsZoneGroupConfigType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name of the private DNS zone group config."
-                                                  }
-                                                },
-                                                "privateDnsZoneResourceId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The resource id of the private DNS zone."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "private-dns-zone-group/main.bicep"
-                                                }
-                                              }
-                                            },
-                                            "roleAssignmentType": {
-                                              "type": "object",
-                                              "properties": {
-                                                "name": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                                                  }
-                                                },
-                                                "roleDefinitionIdOrName": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                                                  }
-                                                },
-                                                "principalId": {
-                                                  "type": "string",
-                                                  "metadata": {
-                                                    "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                                                  }
-                                                },
-                                                "principalType": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "Device",
-                                                    "ForeignGroup",
-                                                    "Group",
-                                                    "ServicePrincipal",
-                                                    "User"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The principal type of the assigned principal ID."
-                                                  }
-                                                },
-                                                "description": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The description of the role assignment."
-                                                  }
-                                                },
-                                                "condition": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                                                  }
-                                                },
-                                                "conditionVersion": {
-                                                  "type": "string",
-                                                  "allowedValues": [
-                                                    "2.0"
-                                                  ],
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. Version of the condition."
-                                                  }
-                                                },
-                                                "delegatedManagedIdentityResourceId": {
-                                                  "type": "string",
-                                                  "nullable": true,
-                                                  "metadata": {
-                                                    "description": "Optional. The Resource Id of the delegated managed identity resource."
-                                                  }
-                                                }
-                                              },
-                                              "metadata": {
-                                                "description": "An AVM-aligned type for a role assignment.",
-                                                "__bicep_imported_from!": {
-                                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.5.1"
-                                                }
-                                              }
-                                            }
-                                          },
-                                          "parameters": {
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Name of the private endpoint resource to create."
-                                              }
-                                            },
-                                            "subnetResourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "Required. Resource ID of the subnet where the endpoint needs to be created."
-                                              }
-                                            },
-                                            "applicationSecurityGroupResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Application security groups in which the private endpoint IP configuration is included."
-                                              }
-                                            },
-                                            "customNetworkInterfaceName": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The custom name of the network interface attached to the private endpoint."
-                                              }
-                                            },
-                                            "ipConfigurations": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/ipConfigurationType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints."
-                                              }
-                                            },
-                                            "privateDnsZoneGroup": {
-                                              "$ref": "#/definitions/privateDnsZoneGroupType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The private DNS zone group to configure for the private endpoint."
-                                              }
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "defaultValue": "[resourceGroup().location]",
-                                              "metadata": {
-                                                "description": "Optional. Location for all Resources."
-                                              }
-                                            },
-                                            "lock": {
-                                              "$ref": "#/definitions/lockType",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. The lock settings of the service."
-                                              }
-                                            },
-                                            "roleAssignments": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/roleAssignmentType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Array of role assignments to create."
-                                              }
-                                            },
-                                            "tags": {
-                                              "type": "object",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Tags to be applied on all resources/resource groups in this deployment."
-                                              }
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Optional. Custom DNS configurations."
-                                              }
-                                            },
-                                            "manualPrivateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Used when the network admin does not have access to approve connections to the remote resource. Required if `privateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "privateLinkServiceConnections": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/privateLinkServiceConnectionType"
-                                              },
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "Conditional. A grouping of information about the connection to the remote resource. Required if `manualPrivateLinkServiceConnections` is empty."
-                                              }
-                                            },
-                                            "enableTelemetry": {
-                                              "type": "bool",
-                                              "defaultValue": true,
-                                              "metadata": {
-                                                "description": "Optional. Enable/Disable usage telemetry for module."
-                                              }
-                                            }
-                                          },
-                                          "variables": {
-                                            "copy": [
-                                              {
-                                                "name": "formattedRoleAssignments",
-                                                "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                                                "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                                              }
-                                            ],
-                                            "builtInRoleNames": {
-                                              "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                                              "DNS Resolver Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0f2ebee7-ffd4-4fc0-b3b7-664099fdad5d')]",
-                                              "DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'befefa01-2a29-4197-83a8-272ff33ce314')]",
-                                              "Domain Services Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'eeaeda52-9324-47f6-8069-5d5bade478b2')]",
-                                              "Domain Services Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '361898ef-9ed1-48c2-849c-a832951106bb')]",
-                                              "Network Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4d97b98b-1d4f-4787-a291-c67834d212e7')]",
-                                              "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                                              "Private DNS Zone Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b12aa53e-6015-4669-85d0-8515ebb3ae7f')]",
-                                              "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                                              "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]"
-                                            }
-                                          },
-                                          "resources": {
-                                            "avmTelemetry": {
-                                              "condition": "[parameters('enableTelemetry')]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2024-03-01",
-                                              "name": "[format('46d3xbcp.res.network-privateendpoint.{0}.{1}', replace('0.11.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                                              "properties": {
-                                                "mode": "Incremental",
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "resources": [],
-                                                  "outputs": {
-                                                    "telemetry": {
-                                                      "type": "String",
-                                                      "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                                                    }
-                                                  }
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint": {
-                                              "type": "Microsoft.Network/privateEndpoints",
-                                              "apiVersion": "2024-05-01",
-                                              "name": "[parameters('name')]",
-                                              "location": "[parameters('location')]",
-                                              "tags": "[parameters('tags')]",
-                                              "properties": {
-                                                "copy": [
-                                                  {
-                                                    "name": "applicationSecurityGroups",
-                                                    "count": "[length(coalesce(parameters('applicationSecurityGroupResourceIds'), createArray()))]",
-                                                    "input": {
-                                                      "id": "[coalesce(parameters('applicationSecurityGroupResourceIds'), createArray())[copyIndex('applicationSecurityGroups')]]"
-                                                    }
-                                                  }
-                                                ],
-                                                "customDnsConfigs": "[coalesce(parameters('customDnsConfigs'), createArray())]",
-                                                "customNetworkInterfaceName": "[coalesce(parameters('customNetworkInterfaceName'), '')]",
-                                                "ipConfigurations": "[coalesce(parameters('ipConfigurations'), createArray())]",
-                                                "manualPrivateLinkServiceConnections": "[coalesce(parameters('manualPrivateLinkServiceConnections'), createArray())]",
-                                                "privateLinkServiceConnections": "[coalesce(parameters('privateLinkServiceConnections'), createArray())]",
-                                                "subnet": {
-                                                  "id": "[parameters('subnetResourceId')]"
-                                                }
-                                              }
-                                            },
-                                            "privateEndpoint_lock": {
-                                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                                              "type": "Microsoft.Authorization/locks",
-                                              "apiVersion": "2020-05-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                                              "properties": {
-                                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                                "notes": "[if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_roleAssignments": {
-                                              "copy": {
-                                                "name": "privateEndpoint_roleAssignments",
-                                                "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                                              },
-                                              "type": "Microsoft.Authorization/roleAssignments",
-                                              "apiVersion": "2022-04-01",
-                                              "scope": "[format('Microsoft.Network/privateEndpoints/{0}', parameters('name'))]",
-                                              "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.Network/privateEndpoints', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                                              "properties": {
-                                                "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                                                "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                                                "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                                                "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                                                "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                                                "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                                                "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            },
-                                            "privateEndpoint_privateDnsZoneGroup": {
-                                              "condition": "[not(empty(parameters('privateDnsZoneGroup')))]",
-                                              "type": "Microsoft.Resources/deployments",
-                                              "apiVersion": "2022-09-01",
-                                              "name": "[format('{0}-PrivateEndpoint-PrivateDnsZoneGroup', uniqueString(deployment().name))]",
-                                              "properties": {
-                                                "expressionEvaluationOptions": {
-                                                  "scope": "inner"
-                                                },
-                                                "mode": "Incremental",
-                                                "parameters": {
-                                                  "name": {
-                                                    "value": "[tryGet(parameters('privateDnsZoneGroup'), 'name')]"
-                                                  },
-                                                  "privateEndpointName": {
-                                                    "value": "[parameters('name')]"
-                                                  },
-                                                  "privateDnsZoneConfigs": {
-                                                    "value": "[parameters('privateDnsZoneGroup').privateDnsZoneGroupConfigs]"
-                                                  }
-                                                },
-                                                "template": {
-                                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                                  "languageVersion": "2.0",
-                                                  "contentVersion": "1.0.0.0",
-                                                  "metadata": {
-                                                    "_generator": {
-                                                      "name": "bicep",
-                                                      "version": "0.34.44.8038",
-                                                      "templateHash": "13997305779829540948"
-                                                    },
-                                                    "name": "Private Endpoint Private DNS Zone Groups",
-                                                    "description": "This module deploys a Private Endpoint Private DNS Zone Group."
-                                                  },
-                                                  "definitions": {
-                                                    "privateDnsZoneGroupConfigType": {
-                                                      "type": "object",
-                                                      "properties": {
-                                                        "name": {
-                                                          "type": "string",
-                                                          "nullable": true,
-                                                          "metadata": {
-                                                            "description": "Optional. The name of the private DNS zone group config."
-                                                          }
-                                                        },
-                                                        "privateDnsZoneResourceId": {
-                                                          "type": "string",
-                                                          "metadata": {
-                                                            "description": "Required. The resource id of the private DNS zone."
-                                                          }
-                                                        }
-                                                      },
-                                                      "metadata": {
-                                                        "__bicep_export!": true
-                                                      }
-                                                    }
-                                                  },
-                                                  "parameters": {
-                                                    "privateEndpointName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "Conditional. The name of the parent private endpoint. Required if the template is used in a standalone deployment."
-                                                      }
-                                                    },
-                                                    "privateDnsZoneConfigs": {
-                                                      "type": "array",
-                                                      "items": {
-                                                        "$ref": "#/definitions/privateDnsZoneGroupConfigType"
-                                                      },
-                                                      "minLength": 1,
-                                                      "maxLength": 5,
-                                                      "metadata": {
-                                                        "description": "Required. Array of private DNS zone configurations of the private DNS zone group. A DNS zone group can support up to 5 DNS zones."
-                                                      }
-                                                    },
-                                                    "name": {
-                                                      "type": "string",
-                                                      "defaultValue": "default",
-                                                      "metadata": {
-                                                        "description": "Optional. The name of the private DNS zone group."
-                                                      }
-                                                    }
-                                                  },
-                                                  "variables": {
-                                                    "copy": [
-                                                      {
-                                                        "name": "privateDnsZoneConfigsVar",
-                                                        "count": "[length(parameters('privateDnsZoneConfigs'))]",
-                                                        "input": {
-                                                          "name": "[coalesce(tryGet(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')], 'name'), last(split(parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId, '/')))]",
-                                                          "properties": {
-                                                            "privateDnsZoneId": "[parameters('privateDnsZoneConfigs')[copyIndex('privateDnsZoneConfigsVar')].privateDnsZoneResourceId]"
-                                                          }
-                                                        }
-                                                      }
-                                                    ]
-                                                  },
-                                                  "resources": {
-                                                    "privateEndpoint": {
-                                                      "existing": true,
-                                                      "type": "Microsoft.Network/privateEndpoints",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[parameters('privateEndpointName')]"
-                                                    },
-                                                    "privateDnsZoneGroup": {
-                                                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
-                                                      "apiVersion": "2024-05-01",
-                                                      "name": "[format('{0}/{1}', parameters('privateEndpointName'), parameters('name'))]",
-                                                      "properties": {
-                                                        "privateDnsZoneConfigs": "[variables('privateDnsZoneConfigsVar')]"
-                                                      }
-                                                    }
-                                                  },
-                                                  "outputs": {
-                                                    "name": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The name of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[parameters('name')]"
-                                                    },
-                                                    "resourceId": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource ID of the private endpoint DNS zone group."
-                                                      },
-                                                      "value": "[resourceId('Microsoft.Network/privateEndpoints/privateDnsZoneGroups', parameters('privateEndpointName'), parameters('name'))]"
-                                                    },
-                                                    "resourceGroupName": {
-                                                      "type": "string",
-                                                      "metadata": {
-                                                        "description": "The resource group the private endpoint DNS zone group was deployed into."
-                                                      },
-                                                      "value": "[resourceGroup().name]"
-                                                    }
-                                                  }
-                                                }
-                                              },
-                                              "dependsOn": [
-                                                "privateEndpoint"
-                                              ]
-                                            }
-                                          },
-                                          "outputs": {
-                                            "resourceGroupName": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource group the private endpoint was deployed into."
-                                              },
-                                              "value": "[resourceGroup().name]"
-                                            },
-                                            "resourceId": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The resource ID of the private endpoint."
-                                              },
-                                              "value": "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
-                                            },
-                                            "name": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The name of the private endpoint."
-                                              },
-                                              "value": "[parameters('name')]"
-                                            },
-                                            "location": {
-                                              "type": "string",
-                                              "metadata": {
-                                                "description": "The location the resource was deployed into."
-                                              },
-                                              "value": "[reference('privateEndpoint', '2024-05-01', 'full').location]"
-                                            },
-                                            "customDnsConfigs": {
-                                              "type": "array",
-                                              "items": {
-                                                "$ref": "#/definitions/customDnsConfigType"
-                                              },
-                                              "metadata": {
-                                                "description": "The custom DNS configurations of the private endpoint."
-                                              },
-                                              "value": "[reference('privateEndpoint').customDnsConfigs]"
-                                            },
-                                            "networkInterfaceResourceIds": {
-                                              "type": "array",
-                                              "items": {
-                                                "type": "string"
-                                              },
-                                              "metadata": {
-                                                "description": "The resource IDs of the network interfaces associated with the private endpoint."
-                                              },
-                                              "value": "[map(reference('privateEndpoint').networkInterfaces, lambda('nic', lambdaVariables('nic').id))]"
-                                            },
-                                            "groupId": {
-                                              "type": "string",
-                                              "nullable": true,
-                                              "metadata": {
-                                                "description": "The group Id for the private endpoint Group."
-                                              },
-                                              "value": "[coalesce(tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'manualPrivateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0), tryGet(tryGet(tryGet(tryGet(reference('privateEndpoint'), 'privateLinkServiceConnections'), 0, 'properties'), 'groupIds'), 0))]"
-                                            }
-                                          }
-                                        }
-                                      },
-                                      "dependsOn": [
-                                        "databaseAccount"
-                                      ]
-                                    }
-                                  },
-                                  "outputs": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the database account."
-                                      },
-                                      "value": "[parameters('name')]"
-                                    },
-                                    "resourceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The resource ID of the database account."
-                                      },
-                                      "value": "[resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('name'))]"
-                                    },
-                                    "resourceGroupName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The name of the resource group the database account was created in."
-                                      },
-                                      "value": "[resourceGroup().name]"
-                                    },
-                                    "systemAssignedMIPrincipalId": {
-                                      "type": "string",
-                                      "nullable": true,
-                                      "metadata": {
-                                        "description": "The principal ID of the system assigned identity."
-                                      },
-                                      "value": "[tryGet(tryGet(reference('databaseAccount', '2024-11-15', 'full'), 'identity'), 'principalId')]"
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The location the resource was deployed into."
-                                      },
-                                      "value": "[reference('databaseAccount', '2024-11-15', 'full').location]"
-                                    },
-                                    "endpoint": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "The endpoint of the database account."
-                                      },
-                                      "value": "[reference('databaseAccount').documentEndpoint]"
-                                    },
-                                    "privateEndpoints": {
-                                      "type": "array",
-                                      "items": {
-                                        "$ref": "#/definitions/privateEndpointOutputType"
-                                      },
-                                      "metadata": {
-                                        "description": "The private endpoints of the database account."
-                                      },
-                                      "copy": {
-                                        "count": "[length(coalesce(parameters('privateEndpoints'), createArray()))]",
-                                        "input": {
-                                          "name": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.name.value]",
-                                          "resourceId": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.resourceId.value]",
-                                          "groupId": "[tryGet(tryGet(reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs, 'groupId'), 'value')]",
-                                          "customDnsConfigs": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.customDnsConfigs.value]",
-                                          "networkInterfaceResourceIds": "[reference(format('databaseAccount_privateEndpoints[{0}]', copyIndex())).outputs.networkInterfaceResourceIds.value]"
-                                        }
-                                      }
-                                    },
-                                    "primaryReadWriteKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary read-write key."
-                                      },
-                                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryMasterKey]"
-                                    },
-                                    "primaryReadOnlyKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary read-only key."
-                                      },
-                                      "value": "[listKeys('databaseAccount', '2024-11-15').primaryReadonlyMasterKey]"
-                                    },
-                                    "primaryReadWriteConnectionString": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary read-write connection string."
-                                      },
-                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[0].connectionString]"
-                                    },
-                                    "primaryReadOnlyConnectionString": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The primary read-only connection string."
-                                      },
-                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[2].connectionString]"
-                                    },
-                                    "secondaryReadWriteKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondary read-write key."
-                                      },
-                                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryMasterKey]"
-                                    },
-                                    "secondaryReadOnlyKey": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondary read-only key."
-                                      },
-                                      "value": "[listKeys('databaseAccount', '2024-11-15').secondaryReadonlyMasterKey]"
-                                    },
-                                    "secondaryReadWriteConnectionString": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondary read-write connection string."
-                                      },
-                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[1].connectionString]"
-                                    },
-                                    "secondaryReadOnlyConnectionString": {
-                                      "type": "securestring",
-                                      "metadata": {
-                                        "description": "The secondary read-only connection string."
-                                      },
-                                      "value": "[listConnectionStrings('databaseAccount', '2024-11-15').connectionStrings[3].connectionString]"
-                                    }
-                                  }
-                                }
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the Cosmos DB."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.name.value, variables('existingName'))]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource ID of the Cosmos DB."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), reference('cosmosDb').outputs.resourceId.value, extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('existingSubscriptionId'), variables('existingResourceGroupName')), 'Microsoft.DocumentDB/databaseAccounts', variables('existingName')))]"
-                            },
-                            "subscriptionId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Subscription ID of the Cosmos DB."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), subscription().subscriptionId, variables('existingSubscriptionId'))]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource Group Name of the Cosmos DB."
-                              },
-                              "value": "[if(empty(parameters('existingResourceId')), resourceGroup().name, variables('existingResourceGroupName'))]"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "foundryProject": {
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[take(format('module.project.main.{0}', variables('projectName')), 64)]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "name": {
-                            "value": "[variables('projectName')]"
-                          },
-                          "desc": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'desc'))), createObject('value', parameters('aiFoundryConfiguration').project.desc), createObject('value', 'This is the default project for AI Foundry.'))]",
-                          "displayName": "[if(not(empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'project'), 'displayName'))), createObject('value', parameters('aiFoundryConfiguration').project.displayName), createObject('value', format('{0} Default Project', parameters('baseName'))))]",
-                          "accountName": {
-                            "value": "[reference('foundryAccount').outputs.name.value]"
-                          },
-                          "location": {
-                            "value": "[reference('foundryAccount').outputs.location.value]"
-                          },
-                          "createAccountCapabilityHost": {
-                            "value": "[and(variables('createCapabilityHosts'), empty(tryGet(tryGet(parameters('aiFoundryConfiguration'), 'networking'), 'agentServiceSubnetResourceId')))]"
-                          },
-                          "createProjectCapabilityHost": {
-                            "value": "[variables('createCapabilityHosts')]"
-                          },
-                          "storageAccountConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('storageAccount').outputs.name.value, 'subscriptionId', reference('storageAccount').outputs.subscriptionId.value, 'resourceGroupName', reference('storageAccount').outputs.resourceGroupName.value)), createObject('value', null()))]",
-                          "aiSearchConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('aiSearch').outputs.name.value, 'subscriptionId', reference('aiSearch').outputs.subscriptionId.value, 'resourceGroupName', reference('aiSearch').outputs.resourceGroupName.value)), createObject('value', null()))]",
-                          "cosmosDbConnection": "[if(parameters('includeAssociatedResources'), createObject('value', createObject('resourceName', reference('cosmosDb').outputs.name.value, 'subscriptionId', reference('cosmosDb').outputs.subscriptionId.value, 'resourceGroupName', reference('cosmosDb').outputs.resourceGroupName.value)), createObject('value', null()))]",
-                          "tags": {
-                            "value": "[parameters('tags')]"
-                          },
-                          "lock": {
-                            "value": "[parameters('lock')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "8997226659817763257"
-                            },
-                            "name": "AI Foundry Project",
-                            "description": "Creates an AI Foundry project and any associated Azure service connections."
-                          },
-                          "definitions": {
-                            "azureConnectionType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. The name of the project connection. Will default to the resource name if not provided."
-                                  }
-                                },
-                                "resourceName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource name of the Azure resource for the connection."
-                                  }
-                                },
-                                "subscriptionId": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The subscription ID of the resource."
-                                  }
-                                },
-                                "resourceGroupName": {
-                                  "type": "string",
-                                  "metadata": {
-                                    "description": "Required. The resource group name of the resource."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "__bicep_export!": true,
-                                "description": "Type representing values to create an Azure connection to an AI Foundry project."
-                              }
-                            },
-                            "lockType": {
-                              "type": "object",
-                              "properties": {
-                                "name": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the name of lock."
-                                  }
-                                },
-                                "kind": {
-                                  "type": "string",
-                                  "allowedValues": [
-                                    "CanNotDelete",
-                                    "None",
-                                    "ReadOnly"
-                                  ],
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the type of lock."
-                                  }
-                                },
-                                "notes": {
-                                  "type": "string",
-                                  "nullable": true,
-                                  "metadata": {
-                                    "description": "Optional. Specify the notes of the lock."
-                                  }
-                                }
-                              },
-                              "metadata": {
-                                "description": "An AVM-aligned type for a lock.",
-                                "__bicep_imported_from!": {
-                                  "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                                }
-                              }
-                            }
-                          },
-                          "parameters": {
-                            "name": {
-                              "type": "string",
-                              "minLength": 2,
-                              "maxLength": 64,
-                              "metadata": {
-                                "description": "Required. The name of the AI Foundry project."
-                              }
-                            },
-                            "displayName": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The display name of the AI Foundry project."
-                              }
-                            },
-                            "desc": {
-                              "type": "string",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The description of the AI Foundry project."
-                              }
-                            },
-                            "location": {
-                              "type": "string",
-                              "defaultValue": "[resourceGroup().location]",
-                              "metadata": {
-                                "description": "Optional. Specifies the location for all the Azure resources."
-                              }
-                            },
-                            "accountName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Required. Name of the existing parent Foundry Account resource."
-                              }
-                            },
-                            "createAccountCapabilityHost": {
-                              "type": "bool",
-                              "metadata": {
-                                "description": "Required. Whether to create the capability host for the Foundry account. Requires associated resource connections to be provided."
-                              }
-                            },
-                            "createProjectCapabilityHost": {
-                              "type": "bool",
-                              "metadata": {
-                                "description": "Required. Whether to create the capability host for the Foundry project. Requires associated resource connections to be provided."
-                              }
-                            },
-                            "cosmosDbConnection": {
-                              "$ref": "#/definitions/azureConnectionType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Azure Cosmos DB connection for the project."
-                              }
-                            },
-                            "aiSearchConnection": {
-                              "$ref": "#/definitions/azureConnectionType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Azure Cognitive Search connection for the project."
-                              }
-                            },
-                            "storageAccountConnection": {
-                              "$ref": "#/definitions/azureConnectionType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. Storage Account connection for the project."
-                              }
-                            },
-                            "lock": {
-                              "$ref": "#/definitions/lockType",
-                              "nullable": true,
-                              "metadata": {
-                                "description": "Optional. The lock settings of the service."
-                              }
-                            },
-                            "tags": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.Resources/resourceGroups@2025-04-01#properties/tags"
-                                },
-                                "description": "Optional. Tags to be applied to the resources."
-                              },
-                              "defaultValue": {}
-                            }
-                          },
-                          "variables": {
-                            "hasConnection": "[or(or(not(empty(parameters('cosmosDbConnection'))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]",
-                            "createProjectCapabilityHostInternal": "[and(and(and(parameters('createProjectCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]",
-                            "createAccountCapabilityHostInternal": "[and(and(and(parameters('createAccountCapabilityHost'), not(empty(parameters('cosmosDbConnection')))), not(empty(parameters('aiSearchConnection')))), not(empty(parameters('storageAccountConnection'))))]"
-                          },
-                          "resources": {
-                            "foundryAccount": {
-                              "existing": true,
-                              "type": "Microsoft.CognitiveServices/accounts",
-                              "apiVersion": "2025-06-01",
-                              "name": "[parameters('accountName')]"
-                            },
-                            "storageAccount": {
-                              "condition": "[not(empty(parameters('storageAccountConnection')))]",
-                              "existing": true,
-                              "type": "Microsoft.Storage/storageAccounts",
-                              "apiVersion": "2025-01-01",
-                              "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]",
-                              "name": "[parameters('storageAccountConnection').resourceName]"
-                            },
-                            "aiSearch": {
-                              "condition": "[not(empty(parameters('aiSearchConnection')))]",
-                              "existing": true,
-                              "type": "Microsoft.Search/searchServices",
-                              "apiVersion": "2025-05-01",
-                              "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]",
-                              "name": "[parameters('aiSearchConnection').resourceName]"
-                            },
-                            "cosmosDb": {
-                              "condition": "[not(empty(parameters('cosmosDbConnection')))]",
-                              "existing": true,
-                              "type": "Microsoft.DocumentDB/databaseAccounts",
-                              "apiVersion": "2025-04-15",
-                              "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]",
-                              "name": "[parameters('cosmosDbConnection').resourceName]"
-                            },
-                            "project": {
-                              "type": "Microsoft.CognitiveServices/accounts/projects",
-                              "apiVersion": "2025-04-01-preview",
-                              "name": "[format('{0}/{1}', parameters('accountName'), parameters('name'))]",
-                              "location": "[parameters('location')]",
-                              "identity": {
-                                "type": "SystemAssigned"
-                              },
-                              "properties": {
-                                "displayName": "[if(not(empty(parameters('displayName'))), parameters('displayName'), parameters('name'))]",
-                                "description": "[if(not(empty(parameters('desc'))), parameters('desc'), parameters('name'))]"
-                              },
-                              "tags": "[parameters('tags')]"
-                            },
-                            "cosmosDbConnectionResource": {
-                              "condition": "[not(empty(parameters('cosmosDbConnection')))]",
-                              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
-                              "apiVersion": "2025-04-01-preview",
-                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('cosmosDbConnection').resourceName)]",
-                              "properties": {
-                                "category": "CosmosDB",
-                                "target": "[reference('cosmosDb').documentEndpoint]",
-                                "authType": "AAD",
-                                "metadata": {
-                                  "ApiType": "Azure",
-                                  "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('cosmosDbConnection').subscriptionId, parameters('cosmosDbConnection').resourceGroupName), 'Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbConnection').resourceName)]",
-                                  "location": "[reference('cosmosDb', '2025-04-15', 'full').location]"
-                                }
-                              },
-                              "dependsOn": [
-                                "cosmosDb",
-                                "cosmosDbRoleAssignments",
-                                "project",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "storageAccountConnectionResource": {
-                              "condition": "[not(empty(parameters('storageAccountConnection')))]",
-                              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
-                              "apiVersion": "2025-04-01-preview",
-                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('storageAccountConnection').resourceName)]",
-                              "properties": {
-                                "category": "AzureStorageAccount",
-                                "target": "[reference('storageAccount').primaryEndpoints.blob]",
-                                "authType": "AAD",
-                                "metadata": {
-                                  "ApiType": "Azure",
-                                  "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('storageAccountConnection').subscriptionId, parameters('storageAccountConnection').resourceGroupName), 'Microsoft.Storage/storageAccounts', parameters('storageAccountConnection').resourceName)]",
-                                  "location": "[reference('storageAccount', '2025-01-01', 'full').location]"
-                                }
-                              },
-                              "dependsOn": [
-                                "cosmosDbConnectionResource",
-                                "project",
-                                "storageAccount",
-                                "storageAccountRoleAssignments",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "aiSearchConnectionResource": {
-                              "condition": "[not(empty(parameters('aiSearchConnection')))]",
-                              "type": "Microsoft.CognitiveServices/accounts/projects/connections",
-                              "apiVersion": "2025-04-01-preview",
-                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), parameters('aiSearchConnection').resourceName)]",
-                              "properties": {
-                                "category": "CognitiveSearch",
-                                "target": "[format('https://{0}.search.windows.net/', parameters('aiSearchConnection').resourceName)]",
-                                "authType": "AAD",
-                                "metadata": {
-                                  "ApiType": "Azure",
-                                  "ResourceId": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('aiSearchConnection').subscriptionId, parameters('aiSearchConnection').resourceGroupName), 'Microsoft.Search/searchServices', parameters('aiSearchConnection').resourceName)]",
-                                  "location": "[reference('aiSearch', '2025-05-01', 'full').location]"
-                                }
-                              },
-                              "dependsOn": [
-                                "aiSearch",
-                                "aiSearchRoleAssignments",
-                                "cosmosDbConnectionResource",
-                                "project",
-                                "storageAccountConnectionResource",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "accountCapabilityHost": {
-                              "condition": "[variables('createAccountCapabilityHostInternal')]",
-                              "type": "Microsoft.CognitiveServices/accounts/capabilityHosts",
-                              "apiVersion": "2025-04-01-preview",
-                              "name": "[format('{0}/{1}', parameters('accountName'), format('chagent{0}', replace(parameters('accountName'), '-', '')))]",
-                              "properties": {
-                                "capabilityHostKind": "Agents",
-                                "tags": "[parameters('tags')]"
-                              },
-                              "dependsOn": [
-                                "aiSearchConnectionResource",
-                                "cosmosDbConnectionResource",
-                                "project",
-                                "storageAccountConnectionResource",
-                                "waitForConnectionsScript"
-                              ]
-                            },
-                            "capabilityHost": {
-                              "condition": "[variables('createProjectCapabilityHostInternal')]",
-                              "type": "Microsoft.CognitiveServices/accounts/projects/capabilityHosts",
-                              "apiVersion": "2025-04-01-preview",
-                              "name": "[format('{0}/{1}/{2}', parameters('accountName'), parameters('name'), format('chagent{0}', replace(parameters('name'), '-', '')))]",
-                              "properties": {
-                                "capabilityHostKind": "Agents",
-                                "threadStorageConnections": [
-                                  "[format('{0}', parameters('cosmosDbConnection').resourceName)]"
-                                ],
-                                "vectorStoreConnections": [
-                                  "[format('{0}', parameters('aiSearchConnection').resourceName)]"
-                                ],
-                                "storageConnections": [
-                                  "[format('{0}', parameters('storageAccountConnection').resourceName)]"
-                                ],
-                                "tags": "[parameters('tags')]"
-                              },
-                              "dependsOn": [
-                                "accountCapabilityHost",
-                                "aiSearchConnectionResource",
-                                "cosmosDbConnectionResource",
-                                "project",
-                                "storageAccountConnectionResource",
-                                "waitForConnectionsScript"
-                              ]
-                            },
-                            "projectLock": {
-                              "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                              "type": "Microsoft.Authorization/locks",
-                              "apiVersion": "2020-05-01",
-                              "scope": "[format('Microsoft.CognitiveServices/accounts/{0}/projects/{1}', parameters('accountName'), parameters('name'))]",
-                              "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                              "properties": {
-                                "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                                "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                              },
-                              "dependsOn": [
-                                "capabilityHost",
-                                "project"
-                              ]
-                            },
-                            "waitForProjectScript": {
-                              "condition": "[variables('hasConnection')]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.waitDeploymentScript.waitForProject.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[format('script-wait-proj-{0}', parameters('name'))]"
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "seconds": {
-                                    "value": 30
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "16818353602719638288"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Name of the deployment script."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Location for the deployment script."
-                                      }
-                                    },
-                                    "seconds": {
-                                      "type": "int",
-                                      "metadata": {
-                                        "description": "Required. Sleep/wait time for the deployment script in seconds."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Resources/deploymentScripts",
-                                      "apiVersion": "2023-08-01",
-                                      "name": "[parameters('name')]",
-                                      "location": "[parameters('location')]",
-                                      "kind": "AzurePowerShell",
-                                      "properties": {
-                                        "azPowerShellVersion": "11.0",
-                                        "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]",
-                                        "timeout": "P1D",
-                                        "cleanupPreference": "Always",
-                                        "retentionInterval": "P1D"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "project"
-                              ]
-                            },
-                            "cosmosDbRoleAssignments": {
-                              "condition": "[not(empty(parameters('cosmosDbConnection')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.role-assign.cosmosDb.{0}', parameters('name')), 64)]",
-                              "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "cosmosDbName": {
-                                    "value": "[parameters('cosmosDbConnection').resourceName]"
-                                  },
-                                  "projectIdentityPrincipalId": {
-                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "2297586848184477491"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "cosmosDbName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the Cosmos DB account."
-                                      }
-                                    },
-                                    "projectIdentityPrincipalId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The principal ID of the project identity."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.DocumentDB/databaseAccounts/{0}', parameters('cosmosDbName'))]",
-                                      "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa'), resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')))]",
-                                      "properties": {
-                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
-                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '230815da-be43-4aae-9cb4-875f7bd000aa')]",
-                                        "principalType": "ServicePrincipal"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "project",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "storageAccountRoleAssignments": {
-                              "condition": "[not(empty(parameters('storageAccountConnection')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.role-assign.storageAccount.{0}', parameters('name')), 64)]",
-                              "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountConnection').resourceName]"
-                                  },
-                                  "projectIdentityPrincipalId": {
-                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "16405095293780360423"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the storage account."
-                                      }
-                                    },
-                                    "projectIdentityPrincipalId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The principal ID of the project identity."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
-                                      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]",
-                                      "properties": {
-                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
-                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
-                                        "principalType": "ServicePrincipal"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "project",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "aiSearchRoleAssignments": {
-                              "condition": "[not(empty(parameters('aiSearchConnection')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.role-assign.aiSearch.{0}', parameters('name')), 64)]",
-                              "subscriptionId": "[parameters('aiSearchConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('aiSearchConnection').resourceGroupName]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "aiSearchName": {
-                                    "value": "[parameters('aiSearchConnection').resourceName]"
-                                  },
-                                  "projectIdentityPrincipalId": {
-                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "16025941000331400340"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "aiSearchName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the AI Search resource."
-                                      }
-                                    },
-                                    "projectIdentityPrincipalId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The principal ID of the project identity."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]",
-                                      "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]",
-                                      "properties": {
-                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
-                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '8ebe5a00-799e-43f5-93ac-243d3dce84a7')]",
-                                        "principalType": "ServicePrincipal"
-                                      }
-                                    },
-                                    {
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Search/searchServices/{0}', parameters('aiSearchName'))]",
-                                      "name": "[guid(parameters('projectIdentityPrincipalId'), resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0'), resourceId('Microsoft.Search/searchServices', parameters('aiSearchName')))]",
-                                      "properties": {
-                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
-                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
-                                        "principalType": "ServicePrincipal"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "project",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "waitForConnectionsScript": {
-                              "condition": "[and(variables('hasConnection'), or(variables('createAccountCapabilityHostInternal'), variables('createProjectCapabilityHostInternal')))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.waitDeploymentScript.waitForConn.{0}', parameters('name')), 64)]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "name": {
-                                    "value": "[format('script-wait-conns-{0}', parameters('name'))]"
-                                  },
-                                  "location": {
-                                    "value": "[parameters('location')]"
-                                  },
-                                  "seconds": {
-                                    "value": 60
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "16818353602719638288"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "name": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Name of the deployment script."
-                                      }
-                                    },
-                                    "location": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. Location for the deployment script."
-                                      }
-                                    },
-                                    "seconds": {
-                                      "type": "int",
-                                      "metadata": {
-                                        "description": "Required. Sleep/wait time for the deployment script in seconds."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Resources/deploymentScripts",
-                                      "apiVersion": "2023-08-01",
-                                      "name": "[parameters('name')]",
-                                      "location": "[parameters('location')]",
-                                      "kind": "AzurePowerShell",
-                                      "properties": {
-                                        "azPowerShellVersion": "11.0",
-                                        "scriptContent": "[format('Write-Host \"Waiting for {0} seconds...\" ; Start-Sleep -Seconds {1}; Write-Host \"Wait complete.\"', parameters('seconds'), parameters('seconds'))]",
-                                        "timeout": "P1D",
-                                        "cleanupPreference": "Always",
-                                        "retentionInterval": "P1D"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "aiSearchConnectionResource",
-                                "cosmosDbConnectionResource",
-                                "project",
-                                "storageAccountConnectionResource",
-                                "waitForProjectScript"
-                              ]
-                            },
-                            "cosmosDbSqlRoleAssignments": {
-                              "condition": "[and(not(empty(parameters('cosmosDbConnection'))), variables('createProjectCapabilityHostInternal'))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.role-assign.cosmosDbDataPlane.{0}', parameters('name')), 64)]",
-                              "subscriptionId": "[parameters('cosmosDbConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('cosmosDbConnection').resourceGroupName]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "cosmosDbName": {
-                                    "value": "[parameters('cosmosDbConnection').resourceName]"
-                                  },
-                                  "projectIdentityPrincipalId": {
-                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
-                                  },
-                                  "projectWorkspaceId": {
-                                    "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "11649050309693252000"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "cosmosDbName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the Cosmos DB account."
-                                      }
-                                    },
-                                    "projectIdentityPrincipalId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The principal ID of the project identity."
-                                      }
-                                    },
-                                    "projectWorkspaceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The project workspace ID."
-                                      }
-                                    }
-                                  },
-                                  "variables": {
-                                    "cosmosContainerNameSuffixes": [
-                                      "thread-message-store",
-                                      "system-thread-message-store",
-                                      "agent-entity-store"
-                                    ],
-                                    "cosmosDefaultSqlRoleDefinitionId": "[resourceId('Microsoft.DocumentDB/databaseAccounts/sqlRoleDefinitions', parameters('cosmosDbName'), '00000000-0000-0000-0000-000000000002')]"
-                                  },
-                                  "resources": [
-                                    {
-                                      "copy": {
-                                        "name": "cosmosDataRoleAssigment",
-                                        "count": "[length(variables('cosmosContainerNameSuffixes'))]",
-                                        "mode": "serial",
-                                        "batchSize": 1
-                                      },
-                                      "type": "Microsoft.DocumentDB/databaseAccounts/sqlRoleAssignments",
-                                      "apiVersion": "2025-04-15",
-                                      "name": "[format('{0}/{1}', parameters('cosmosDbName'), guid(variables('cosmosDefaultSqlRoleDefinitionId'), parameters('cosmosDbName'), variables('cosmosContainerNameSuffixes')[copyIndex()], parameters('projectIdentityPrincipalId')))]",
-                                      "properties": {
-                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
-                                        "roleDefinitionId": "[variables('cosmosDefaultSqlRoleDefinitionId')]",
-                                        "scope": "[format('{0}/dbs/enterprise_memory/colls/{1}-{2}', resourceId('Microsoft.DocumentDB/databaseAccounts', parameters('cosmosDbName')), parameters('projectWorkspaceId'), variables('cosmosContainerNameSuffixes')[copyIndex()])]"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "capabilityHost",
-                                "cosmosDbRoleAssignments",
-                                "project"
-                              ]
-                            },
-                            "storageAccountContainerRoleAssignments": {
-                              "condition": "[and(not(empty(parameters('storageAccountConnection'))), variables('createProjectCapabilityHostInternal'))]",
-                              "type": "Microsoft.Resources/deployments",
-                              "apiVersion": "2025-04-01",
-                              "name": "[take(format('module.project.role-assign.storageAccountDataPlane.{0}', parameters('name')), 64)]",
-                              "subscriptionId": "[parameters('storageAccountConnection').subscriptionId]",
-                              "resourceGroup": "[parameters('storageAccountConnection').resourceGroupName]",
-                              "properties": {
-                                "expressionEvaluationOptions": {
-                                  "scope": "inner"
-                                },
-                                "mode": "Incremental",
-                                "parameters": {
-                                  "storageAccountName": {
-                                    "value": "[parameters('storageAccountConnection').resourceName]"
-                                  },
-                                  "projectIdentityPrincipalId": {
-                                    "value": "[reference('project', '2025-04-01-preview', 'full').identity.principalId]"
-                                  },
-                                  "projectWorkspaceId": {
-                                    "value": "[format('{0}-{1}-{2}-{3}-{4}', if(greaterOrEquals(length(reference('project').internalId), 8), substring(reference('project').internalId, 0, 8), ''), if(greaterOrEquals(length(reference('project').internalId), 12), substring(reference('project').internalId, 8, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 16), substring(reference('project').internalId, 12, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 20), substring(reference('project').internalId, 16, 4), ''), if(greaterOrEquals(length(reference('project').internalId), 32), substring(reference('project').internalId, 20, 12), ''))]"
-                                  }
-                                },
-                                "template": {
-                                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                                  "contentVersion": "1.0.0.0",
-                                  "metadata": {
-                                    "_generator": {
-                                      "name": "bicep",
-                                      "version": "0.38.33.27573",
-                                      "templateHash": "12109249428053532616"
-                                    }
-                                  },
-                                  "parameters": {
-                                    "storageAccountName": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The name of the storage account."
-                                      }
-                                    },
-                                    "projectIdentityPrincipalId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The principal ID of the project identity."
-                                      }
-                                    },
-                                    "projectWorkspaceId": {
-                                      "type": "string",
-                                      "metadata": {
-                                        "description": "Required. The project workspace ID."
-                                      }
-                                    }
-                                  },
-                                  "resources": [
-                                    {
-                                      "type": "Microsoft.Authorization/roleAssignments",
-                                      "apiVersion": "2022-04-01",
-                                      "scope": "[format('Microsoft.Storage/storageAccounts/{0}', parameters('storageAccountName'))]",
-                                      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName')), resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b'), parameters('storageAccountName'), parameters('projectIdentityPrincipalId'))]",
-                                      "properties": {
-                                        "principalId": "[parameters('projectIdentityPrincipalId')]",
-                                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
-                                        "principalType": "ServicePrincipal",
-                                        "conditionVersion": "2.0",
-                                        "condition": "[replace('      (\n        (\n          !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/read''})\n          AND  !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/filter/action''})\n          AND  !(ActionMatches{''Microsoft.Storage/storageAccounts/blobServices/containers/blobs/tags/write''})\n        )\n        OR\n        (@Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringStartsWithIgnoreCase ''#projectWorkspaceId#''\n        AND @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringLikeIgnoreCase ''*-azureml-agent'')\n      )\n      ', '#projectWorkspaceId#', parameters('projectWorkspaceId'))]"
-                                      }
-                                    }
-                                  ]
-                                }
-                              },
-                              "dependsOn": [
-                                "capabilityHost",
-                                "cosmosDbSqlRoleAssignments",
-                                "project",
-                                "storageAccountRoleAssignments"
-                              ]
-                            }
-                          },
-                          "outputs": {
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the deployed Azure Resource Group."
-                              },
-                              "value": "[resourceGroup().name]"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Resource ID of the Project."
-                              },
-                              "value": "[resourceId('Microsoft.CognitiveServices/accounts/projects', parameters('accountName'), parameters('name'))]"
-                            },
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Name of the Project."
-                              },
-                              "value": "[parameters('name')]"
-                            },
-                            "displayName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Display name of the Project."
-                              },
-                              "value": "[reference('project').displayName]"
-                            },
-                            "desc": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Description of the Project."
-                              },
-                              "value": "[reference('project').description]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "aiSearch",
-                        "cosmosDb",
-                        "foundryAccount",
-                        "keyVault",
-                        "storageAccount"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure Resource Group."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "keyVaultName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure Key Vault."
-                      },
-                      "value": "[if(parameters('includeAssociatedResources'), reference('keyVault').outputs.name.value, '')]"
-                    },
-                    "aiServicesName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure AI Services account."
-                      },
-                      "value": "[reference('foundryAccount').outputs.name.value]"
-                    },
-                    "aiSearchName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure AI Search service."
-                      },
-                      "value": "[if(parameters('includeAssociatedResources'), reference('aiSearch').outputs.name.value, '')]"
-                    },
-                    "aiProjectName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure AI Project."
-                      },
-                      "value": "[reference('foundryProject').outputs.name.value]"
-                    },
-                    "storageAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure Storage Account."
-                      },
-                      "value": "[if(parameters('includeAssociatedResources'), reference('storageAccount').outputs.name.value, '')]"
-                    },
-                    "cosmosAccountName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Name of the deployed Azure Cosmos DB account."
-                      },
-                      "value": "[if(parameters('includeAssociatedResources'), reference('cosmosDb').outputs.name.value, '')]"
-                    }
-                  }
-                }
-              }
-            }
-          },
-          "outputs": {
-            "aiProjectName": {
-              "type": "string",
-              "value": "[reference('aiFoundry').outputs.aiProjectName.value]"
-            },
-            "aiServicesName": {
-              "type": "string",
-              "value": "[reference('aiFoundry').outputs.aiServicesName.value]"
-            },
-            "location": {
-              "type": "string",
-              "value": "[parameters('location')]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "userAssignedIdentity"
-      ]
-    },
-    "openaiRoleAssignment": {
-      "condition": "[not(empty(parameters('existingOpenAIResourceId')))]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('openai-role-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "openAIResourceId": {
-            "value": "[parameters('existingOpenAIResourceId')]"
-          },
-          "principalIds": "[if(not(empty(parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value, parameters('principalId'))), createObject('value', createArray(reference('userAssignedIdentity').outputs.principalId.value)))]"
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "languageVersion": "2.0",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "13260682214751199157"
-            }
-          },
-          "parameters": {
-            "openAIResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Resource ID of the existing Azure OpenAI / Cognitive Services resource"
-              }
-            },
-            "principalIds": {
-              "type": "array",
-              "items": {
-                "type": "string"
-              },
-              "metadata": {
-                "description": "Principal IDs of the managed identities to assign the role to"
-              }
-            }
-          },
-          "variables": {
-            "roleDefinitionId": "5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
-          },
-          "resources": {
-            "openAIResource": {
-              "existing": true,
-              "type": "Microsoft.CognitiveServices/accounts",
-              "apiVersion": "2024-10-01",
-              "name": "[last(split(parameters('openAIResourceId'), '/'))]"
-            },
-            "roleAssignment": {
-              "copy": {
-                "name": "roleAssignment",
-                "count": "[length(parameters('principalIds'))]"
-              },
-              "type": "Microsoft.Authorization/roleAssignments",
-              "apiVersion": "2022-04-01",
-              "scope": "[resourceId('Microsoft.CognitiveServices/accounts', last(split(parameters('openAIResourceId'), '/')))]",
-              "name": "[guid(parameters('openAIResourceId'), variables('roleDefinitionId'), parameters('principalIds')[copyIndex()])]",
-              "properties": {
-                "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('roleDefinitionId'))]",
-                "principalId": "[parameters('principalIds')[copyIndex()]]",
-                "principalType": "ServicePrincipal"
-              }
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "userAssignedIdentity"
-      ]
-    },
-    "caeDnsZone": {
-      "condition": "[variables('isAILZIntegrated')]",
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('cae-dns-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "caeDefaultDomain": {
-            "value": "[reference('containerAppsEnvironment').outputs.defaultDomain.value]"
-          },
-          "caeStaticIp": {
-            "value": "[reference('containerAppsEnvironment').outputs.staticIp.value]"
-          },
-          "vnetResourceId": {
-            "value": "[parameters('existingVnetResourceId')]"
-          },
-          "tags": {
-            "value": "[variables('tags')]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "4227343491510839529"
-            }
-          },
-          "parameters": {
-            "caeDefaultDomain": {
-              "type": "string",
-              "metadata": {
-                "description": "The default domain of the Container Apps Environment (e.g. ambitiousdesert-f1f7e820.eastus.azurecontainerapps.io)"
-              }
-            },
-            "caeStaticIp": {
-              "type": "string",
-              "metadata": {
-                "description": "The static IP of the Container Apps Environment"
-              }
-            },
-            "vnetResourceId": {
-              "type": "string",
-              "metadata": {
-                "description": "Resource ID of the VNet to link the DNS zone to"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags for resources"
-              }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Network/privateDnsZones",
-              "apiVersion": "2024-06-01",
-              "name": "[parameters('caeDefaultDomain')]",
-              "location": "global",
-              "tags": "[parameters('tags')]"
-            },
-            {
-              "type": "Microsoft.Network/privateDnsZones/A",
-              "apiVersion": "2024-06-01",
-              "name": "[format('{0}/{1}', parameters('caeDefaultDomain'), '*')]",
-              "properties": {
-                "ttl": 300,
-                "aRecords": [
-                  {
-                    "ipv4Address": "[parameters('caeStaticIp')]"
-                  }
-                ]
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
-              ]
-            },
-            {
-              "type": "Microsoft.Network/privateDnsZones/A",
-              "apiVersion": "2024-06-01",
-              "name": "[format('{0}/{1}', parameters('caeDefaultDomain'), '@')]",
-              "properties": {
-                "ttl": 300,
-                "aRecords": [
-                  {
-                    "ipv4Address": "[parameters('caeStaticIp')]"
-                  }
-                ]
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
-              ]
-            },
-            {
-              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
-              "apiVersion": "2024-06-01",
-              "name": "[format('{0}/{1}', parameters('caeDefaultDomain'), format('{0}-cae-link', last(split(parameters('vnetResourceId'), '/'))))]",
-              "location": "global",
-              "tags": "[parameters('tags')]",
-              "properties": {
-                "virtualNetwork": {
-                  "id": "[parameters('vnetResourceId')]"
-                },
-                "registrationEnabled": false
-              },
-              "dependsOn": [
-                "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
-              ]
-            }
-          ],
-          "outputs": {
-            "dnsZoneId": {
-              "type": "string",
-              "value": "[resourceId('Microsoft.Network/privateDnsZones', parameters('caeDefaultDomain'))]"
-            },
-            "dnsZoneName": {
-              "type": "string",
-              "value": "[parameters('caeDefaultDomain')]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "containerAppsEnvironment"
-      ]
-    },
-    "apiContainerApp": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('ca-api-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('apiContainerAppName')]"
-          },
-          "location": {
-            "value": "[reference('containerAppsEnvironment').outputs.location.value]"
-          },
-          "containerAppsEnvId": {
-            "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
-          },
-          "containerRegistryServer": {
-            "value": "[reference('containerRegistry').outputs.loginServer.value]"
-          },
-          "managedIdentityId": {
-            "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
-          },
-          "targetPort": {
-            "value": 8090
-          },
-          "externalIngress": {
-            "value": true
-          },
-          "corsEnabled": {
-            "value": true
-          },
-          "livenessProbePath": {
-            "value": ""
-          },
-          "cpuCores": {
-            "value": 2
-          },
-          "memoryInGB": {
-            "value": "4Gi"
-          },
-          "minReplicas": {
-            "value": 0
-          },
-          "maxReplicas": {
-            "value": 2
-          },
-          "environmentVariables": {
-            "value": [
-              {
-                "name": "AZURE_APP_CONFIG_ENDPOINT",
-                "value": "[reference('appConfigStore').outputs.endpoint.value]"
-              },
-              {
-                "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
-                "value": "[if(not(empty(parameters('existingAppInsightsId'))), reference(parameters('existingAppInsightsId'), '2020-02-02').ConnectionString, if(variables('shouldCreateAppInsights'), reference('appInsights').outputs.connectionString.value, ''))]"
-              },
-              {
-                "name": "AZURE_CLIENT_ID",
-                "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
-              },
-              {
-                "name": "WORKER_ENGINE_API_ENDPOINT",
-                "value": "[format('https://{0}', reference('workerContainerApp').outputs.fqdn.value)]"
-              },
-              {
-                "name": "AZURE_STORAGE_ACCOUNT_NAME",
-                "value": "[variables('storageAccountName')]"
-              },
-              {
-                "name": "AZURE_CONTENT_UNDERSTANDING_ENDPOINT",
-                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
-              },
-              {
-                "name": "AZURE_OPENAI_ENDPOINT",
-                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
-              }
-            ]
-          },
-          "tags": {
-            "value": "[union(variables('tags'), createObject('azd-service-name', 'api'))]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "2552967140578694385"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Name of the container app"
-              }
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "Location for the container app"
-              }
-            },
-            "containerAppsEnvId": {
-              "type": "string",
-              "metadata": {
-                "description": "Container Apps Environment ID"
-              }
-            },
-            "containerRegistryServer": {
-              "type": "string",
-              "metadata": {
-                "description": "Container Registry server"
-              }
-            },
-            "managedIdentityId": {
-              "type": "string",
-              "metadata": {
-                "description": "Managed Identity Resource ID"
-              }
-            },
-            "targetPort": {
-              "type": "int",
-              "metadata": {
-                "description": "Target port for the container"
-              }
-            },
-            "externalIngress": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Enable external ingress. Defaults to true."
-              }
-            },
-            "corsEnabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Enable CORS. Defaults to true."
-              }
-            },
-            "cpuCores": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "CPU cores for the container. Defaults to 1."
-              }
-            },
-            "memoryInGB": {
-              "type": "string",
-              "defaultValue": "2Gi",
-              "metadata": {
-                "description": "Memory in GB for the container. Defaults to 2Gi."
-              }
-            },
-            "livenessProbePath": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Liveness probe path. Leave empty to disable liveness probe. Defaults to /health."
-              }
-            },
-            "minReplicas": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "Minimum number of replicas for scaling. Defaults to 1."
-              }
-            },
-            "maxReplicas": {
-              "type": "int",
-              "defaultValue": 2,
-              "metadata": {
-                "description": "Maximum number of replicas for scaling. Defaults to 2."
-              }
-            },
-            "environmentVariables": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Environment variables"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags to apply to resources"
-              }
-            },
-            "containerImage": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning)."
-              }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}.containerApp', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "environmentResourceId": {
-                    "value": "[parameters('containerAppsEnvId')]"
-                  },
-                  "corsPolicy": "[if(parameters('corsEnabled'), createObject('value', createObject('allowedOrigins', createArray('*'), 'allowedMethods', createArray('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'), 'allowedHeaders', createArray('*'), 'exposeHeaders', createArray('*'), 'maxAge', 3600, 'allowCredentials', true())), createObject('value', null()))]",
-                  "containers": {
-                    "value": [
-                      {
-                        "name": "[parameters('name')]",
-                        "image": "[if(not(empty(parameters('containerImage'))), parameters('containerImage'), 'mcr.microsoft.com/k8se/quickstart:latest')]",
-                        "resources": {
-                          "cpu": "[parameters('cpuCores')]",
-                          "memory": "[parameters('memoryInGB')]"
-                        },
-                        "env": "[parameters('environmentVariables')]",
-                        "probes": "[if(not(empty(parameters('livenessProbePath'))), createArray(createObject('type', 'Liveness', 'httpGet', createObject('path', parameters('livenessProbePath'), 'port', parameters('targetPort')), 'initialDelaySeconds', 5, 'periodSeconds', 60)), createArray())]"
-                      }
-                    ]
-                  },
-                  "ingressAllowInsecure": {
-                    "value": false
-                  },
-                  "ingressExternal": {
-                    "value": "[parameters('externalIngress')]"
-                  },
-                  "ingressTargetPort": {
-                    "value": "[parameters('targetPort')]"
-                  },
-                  "ingressTransport": {
-                    "value": "auto"
-                  },
-                  "activeRevisionsMode": {
-                    "value": "Single"
-                  },
-                  "managedIdentities": {
-                    "value": {
-                      "userAssignedResourceIds": [
-                        "[parameters('managedIdentityId')]"
-                      ]
-                    }
-                  },
-                  "registries": {
-                    "value": [
-                      {
-                        "server": "[parameters('containerRegistryServer')]",
-                        "identity": "[parameters('managedIdentityId')]"
-                      }
-                    ]
-                  },
-                  "scaleSettings": {
-                    "value": {
-                      "minReplicas": "[parameters('minReplicas')]",
-                      "maxReplicas": "[parameters('maxReplicas')]",
-                      "rules": "[if(greater(parameters('maxReplicas'), 1), createArray(createObject('name', 'http-scaler', 'http', createObject('metadata', createObject('concurrentRequests', '10')))), createArray())]"
-                    }
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.38.33.27573",
-                      "templateHash": "7056981135113238663"
-                    },
-                    "name": "Container Apps",
-                    "description": "This module deploys a Container App."
-                  },
-                  "definitions": {
-                    "ingressPortMappingType": {
-                      "type": "object",
-                      "properties": {
-                        "exposedPort": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
-                          }
-                        },
-                        "external": {
-                          "type": "bool",
-                          "metadata": {
-                            "description": "Required. Specifies whether the app port is accessible outside of the environment."
-                          }
-                        },
-                        "targetPort": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. Specifies the port the container listens on."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an ingress port mapping."
-                      }
-                    },
-                    "serviceBindingType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the service."
-                          }
-                        },
-                        "serviceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The service ID."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a service binding."
-                      }
-                    },
-                    "environmentVarType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Environment variable name."
-                          }
-                        },
-                        "secretRef": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
-                          }
-                        },
-                        "value": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Non-secret environment variable value."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an environment variable."
-                      }
-                    },
-                    "containerAppProbeType": {
-                      "type": "object",
-                      "properties": {
-                        "failureThreshold": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 10,
-                          "metadata": {
-                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
-                          }
-                        },
-                        "httpGet": {
-                          "$ref": "#/definitions/containerAppProbeHttpGetType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. HTTPGet specifies the http request to perform."
-                          }
-                        },
-                        "initialDelaySeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 60,
-                          "metadata": {
-                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
-                          }
-                        },
-                        "periodSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 240,
-                          "metadata": {
-                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
-                          }
-                        },
-                        "successThreshold": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 10,
-                          "metadata": {
-                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
-                          }
-                        },
-                        "tcpSocket": {
-                          "$ref": "#/definitions/containerAppProbeTcpSocketType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
-                          }
-                        },
-                        "terminationGracePeriodSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
-                          }
-                        },
-                        "timeoutSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 240,
-                          "metadata": {
-                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
-                          }
-                        },
-                        "type": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Liveness",
-                            "Readiness",
-                            "Startup"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The type of probe."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe."
-                      }
-                    },
-                    "corsPolicyType": {
-                      "type": "object",
-                      "properties": {
-                        "allowCredentials": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Switch to determine whether the resource allows credentials."
-                          }
-                        },
-                        "allowedHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-headers header."
-                          }
-                        },
-                        "allowedMethods": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-methods header."
-                          }
-                        },
-                        "allowedOrigins": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-origins header."
-                          }
-                        },
-                        "exposeHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-expose-headers header."
-                          }
-                        },
-                        "maxAge": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-max-age header."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a CORS policy."
-                      }
-                    },
-                    "containerAppProbeHttpGetType": {
-                      "type": "object",
-                      "properties": {
-                        "host": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
-                          }
-                        },
-                        "httpHeaders": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. HTTP headers to set in the request."
-                          }
-                        },
-                        "path": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Path to access on the HTTP server."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. Name or number of the port to access on the container."
-                          }
-                        },
-                        "scheme": {
-                          "type": "string",
-                          "allowedValues": [
-                            "HTTP",
-                            "HTTPS"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe HTTP GET."
-                      }
-                    },
-                    "containerAppProbeHttpGetHeadersItemType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the header."
-                          }
-                        },
-                        "value": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Value of the header."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe HTTP GET header."
-                      }
-                    },
-                    "containerAppProbeTcpSocketType": {
-                      "type": "object",
-                      "properties": {
-                        "host": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Host name to connect to, defaults to the pod IP."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "minValue": 1,
-                          "maxValue": 65535,
-                          "metadata": {
-                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe TCP socket."
-                      }
-                    },
-                    "scaleType": {
-                      "type": "object",
-                      "properties": {
-                        "maxReplicas": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The maximum number of replicas."
-                          }
-                        },
-                        "minReplicas": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The minimum number of replicas."
-                          }
-                        },
-                        "cooldownPeriod": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The cooldown period in seconds."
-                          }
-                        },
-                        "pollingInterval": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The polling interval in seconds."
-                          }
-                        },
-                        "rules": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/scaleRuleType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The scaling rules."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The scale settings for the Container App."
-                      }
-                    },
-                    "scaleRuleType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the scaling rule."
-                          }
-                        },
-                        "custom": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom scaling rule."
-                          }
-                        },
-                        "azureQueue": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Azure Queue based scaling rule."
-                          }
-                        },
-                        "http": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The HTTP requests based scaling rule."
-                          }
-                        },
-                        "tcp": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The TCP based scaling rule."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The scaling rules for the Container App."
-                      }
-                    },
-                    "volumeMountType": {
-                      "type": "object",
-                      "properties": {
-                        "mountPath": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
-                          }
-                        },
-                        "subPath": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
-                          }
-                        },
-                        "volumeName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. This must match the Name of a Volume."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a volume mount."
-                      }
-                    },
-                    "secretType": {
-                      "type": "object",
-                      "properties": {
-                        "identity": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
-                          }
-                        },
-                        "keyVaultUrl": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
-                          }
-                        },
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the container app secret."
-                          }
-                        },
-                        "value": {
-                          "type": "securestring",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a secret."
-                      }
-                    },
-                    "authConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "encryptionSettings": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
-                            },
-                            "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "globalValidation": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
-                            },
-                            "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "httpSettings": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
-                            },
-                            "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "identityProviders": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
-                            },
-                            "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "login": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
-                            },
-                            "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "platform": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
-                            },
-                            "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the container app's authentication configuration."
-                      }
-                    },
-                    "diagnosticSettingMetricsOnlyType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of diagnostic setting."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Container App."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "defaultValue": "containerapps",
-                      "allowedValues": [
-                        "containerapps",
-                        "workflowapp",
-                        "functionapp"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Metadata used to render different experiences for resources of the same type."
-                      }
-                    },
-                    "disableIngress": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Bool to disable all ingress traffic for the container app."
-                      }
-                    },
-                    "ingressExternal": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
-                      }
-                    },
-                    "clientCertificateMode": {
-                      "type": "string",
-                      "defaultValue": "ignore",
-                      "allowedValues": [
-                        "accept",
-                        "ignore",
-                        "require"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Client certificate mode for mTLS."
-                      }
-                    },
-                    "corsPolicy": {
-                      "$ref": "#/definitions/corsPolicyType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Object userd to configure CORS policy."
-                      }
-                    },
-                    "stickySessionsAffinity": {
-                      "type": "string",
-                      "defaultValue": "none",
-                      "allowedValues": [
-                        "none",
-                        "sticky"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
-                      }
-                    },
-                    "ingressTransport": {
-                      "type": "string",
-                      "defaultValue": "auto",
-                      "allowedValues": [
-                        "auto",
-                        "http",
-                        "http2",
-                        "tcp"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Ingress transport protocol."
-                      }
-                    },
-                    "service": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/service"
-                        },
-                        "description": "Optional. Dev ContainerApp service type."
-                      },
-                      "nullable": true
-                    },
-                    "includeAddOns": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Toggle to include the service configuration."
-                      }
-                    },
-                    "additionalPortMappings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ingressPortMappingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Settings to expose additional ports on container app."
-                      }
-                    },
-                    "ingressAllowInsecure": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
-                      }
-                    },
-                    "ingressTargetPort": {
-                      "type": "int",
-                      "defaultValue": 80,
-                      "metadata": {
-                        "description": "Optional. Target Port in containers for traffic from ingress."
-                      }
-                    },
-                    "scaleSettings": {
-                      "$ref": "#/definitions/scaleType",
-                      "defaultValue": {
-                        "maxReplicas": 10,
-                        "minReplicas": 3
-                      },
-                      "metadata": {
-                        "description": "Optional. The scaling settings of the service."
-                      }
-                    },
-                    "serviceBinds": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/serviceBindingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. List of container app services bound to the app."
-                      }
-                    },
-                    "activeRevisionsMode": {
-                      "type": "string",
-                      "defaultValue": "Single",
-                      "allowedValues": [
-                        "Multiple",
-                        "Single"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Controls how active revisions are handled for the Container app."
-                      }
-                    },
-                    "environmentResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of environment."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "registries": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/registries"
-                        },
-                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
-                      },
-                      "nullable": true
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "customDomains": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/customDomains"
-                        },
-                        "description": "Optional. Custom domain bindings for Container App hostnames."
-                      },
-                      "nullable": true
-                    },
-                    "exposedPort": {
-                      "type": "int",
-                      "defaultValue": 0,
-                      "metadata": {
-                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
-                      }
-                    },
-                    "ipSecurityRestrictions": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/ipSecurityRestrictions"
-                        },
-                        "description": "Optional. Rules to restrict incoming IP address."
-                      },
-                      "nullable": true
-                    },
-                    "trafficLabel": {
-                      "type": "string",
-                      "defaultValue": "label-1",
-                      "metadata": {
-                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
-                      }
-                    },
-                    "trafficLatestRevision": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
-                      }
-                    },
-                    "trafficRevisionName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Name of a revision."
-                      }
-                    },
-                    "trafficWeight": {
-                      "type": "int",
-                      "defaultValue": 100,
-                      "metadata": {
-                        "description": "Optional. Traffic weight assigned to a revision."
-                      }
-                    },
-                    "dapr": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/dapr"
-                        },
-                        "description": "Optional. Dapr configuration for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "identitySettings": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/identitySettings"
-                        },
-                        "description": "Optional. Settings for Managed Identities that are assigned to the Container App. If a Managed Identity is not specified here, default settings will be used."
-                      },
-                      "nullable": true
-                    },
-                    "maxInactiveRevisions": {
-                      "type": "int",
-                      "defaultValue": 0,
-                      "metadata": {
-                        "description": "Optional. Max inactive revisions a Container App can have."
-                      }
-                    },
-                    "runtime": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/runtime"
-                        },
-                        "description": "Optional. Runtime configuration for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "containers": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/containers"
-                        },
-                        "description": "Required. List of container definitions for the Container App."
-                      }
-                    },
-                    "terminationGracePeriodSeconds": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The termination grace period for the container app."
-                      }
-                    },
-                    "initContainersTemplate": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/initContainers"
-                        },
-                        "description": "Optional. List of specialized containers that run before app containers."
-                      },
-                      "nullable": true
-                    },
-                    "secrets": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The secrets of the Container App."
-                      }
-                    },
-                    "revisionSuffix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. User friendly suffix that is appended to the revision name."
-                      }
-                    },
-                    "volumes": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/volumes"
-                        },
-                        "description": "Optional. List of volume definitions for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "workloadProfileName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Workload profile name to pin for container app execution."
-                      }
-                    },
-                    "authConfig": {
-                      "$ref": "#/definitions/authConfigType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The name of the Container App Auth configs."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "containerApp": {
-                      "type": "Microsoft.App/containerApps",
-                      "apiVersion": "2025-02-02-preview",
-                      "name": "[parameters('name')]",
-                      "tags": "[parameters('tags')]",
-                      "kind": "[parameters('kind')]",
-                      "location": "[parameters('location')]",
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "environmentId": "[parameters('environmentResourceId')]",
-                        "workloadProfileName": "[parameters('workloadProfileName')]",
-                        "template": {
-                          "containers": "[parameters('containers')]",
-                          "terminationGracePeriodSeconds": "[parameters('terminationGracePeriodSeconds')]",
-                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
-                          "revisionSuffix": "[parameters('revisionSuffix')]",
-                          "scale": "[parameters('scaleSettings')]",
-                          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
-                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
-                        },
-                        "configuration": {
-                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
-                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
-                          "identitySettings": "[if(not(empty(parameters('identitySettings'))), parameters('identitySettings'), null())]",
-                          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
-                          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
-                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
-                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
-                          "secrets": "[parameters('secrets')]",
-                          "runtime": "[if(not(empty(parameters('runtime'))), parameters('runtime'), null())]"
-                        }
-                      }
-                    },
-                    "containerApp_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerApp_roleAssignments": {
-                      "copy": {
-                        "name": "containerApp_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerApp_diagnosticSettings": {
-                      "copy": {
-                        "name": "containerApp_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerAppAuthConfigs": {
-                      "condition": "[not(empty(parameters('authConfig')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[format('{0}-auth-config', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "containerAppName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "encryptionSettings": {
-                            "value": "[tryGet(parameters('authConfig'), 'encryptionSettings')]"
-                          },
-                          "globalValidation": {
-                            "value": "[tryGet(parameters('authConfig'), 'globalValidation')]"
-                          },
-                          "httpSettings": {
-                            "value": "[tryGet(parameters('authConfig'), 'httpSettings')]"
-                          },
-                          "identityProviders": {
-                            "value": "[tryGet(parameters('authConfig'), 'identityProviders')]"
-                          },
-                          "login": {
-                            "value": "[tryGet(parameters('authConfig'), 'login')]"
-                          },
-                          "platform": {
-                            "value": "[tryGet(parameters('authConfig'), 'platform')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "12480411243596309951"
-                            },
-                            "name": "Container App Auth Configs",
-                            "description": "This module deploys Container App Auth Configs."
-                          },
-                          "parameters": {
-                            "containerAppName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Container App. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "encryptionSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
-                                },
-                                "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "globalValidation": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
-                                },
-                                "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "httpSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
-                                },
-                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "identityProviders": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
-                                },
-                                "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "login": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
-                                },
-                                "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "platform": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
-                                },
-                                "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "resources": {
-                            "containerApp": {
-                              "existing": true,
-                              "type": "Microsoft.App/containerApps",
-                              "apiVersion": "2025-02-02-preview",
-                              "name": "[parameters('containerAppName')]"
-                            },
-                            "containerAppAuthConfigs": {
-                              "type": "Microsoft.App/containerApps/authConfigs",
-                              "apiVersion": "2025-02-02-preview",
-                              "name": "[format('{0}/{1}', parameters('containerAppName'), 'current')]",
-                              "properties": {
-                                "encryptionSettings": "[parameters('encryptionSettings')]",
-                                "globalValidation": "[parameters('globalValidation')]",
-                                "httpSettings": "[parameters('httpSettings')]",
-                                "identityProviders": "[parameters('identityProviders')]",
-                                "login": "[parameters('login')]",
-                                "platform": "[parameters('platform')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the set of Container App Auth configs."
-                              },
-                              "value": "current"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the set of Container App Auth configs."
-                              },
-                              "value": "[resourceId('Microsoft.App/containerApps/authConfigs', parameters('containerAppName'), 'current')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group containing the set of Container App Auth configs."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Container App."
-                      },
-                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
-                    },
-                    "fqdn": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The configuration of ingress fqdn."
-                      },
-                      "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the Container App was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Container App."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('containerApp', '2025-02-02-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('containerApp', '2025-02-02-preview', 'full').location]"
-                    }
-                  }
-                }
-              }
-            }
-          ],
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.resourceId.value]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[format('{0}.containerApp', deployment().name)]"
-            },
-            "fqdn": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.fqdn.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "aiFoundry",
-        "appConfigStore",
-        "appInsights",
-        "containerAppsEnvironment",
-        "containerRegistry",
-        "userAssignedIdentity",
-        "workerContainerApp"
-      ]
-    },
-    "workerContainerApp": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('ca-worker-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('workerContainerAppName')]"
-          },
-          "location": {
-            "value": "[reference('containerAppsEnvironment').outputs.location.value]"
-          },
-          "containerAppsEnvId": {
-            "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
-          },
-          "containerRegistryServer": {
-            "value": "[reference('containerRegistry').outputs.loginServer.value]"
-          },
-          "managedIdentityId": {
-            "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
-          },
-          "targetPort": {
-            "value": "[parameters('workerContainerAppTargetPort')]"
-          },
-          "externalIngress": {
-            "value": true
-          },
-          "corsEnabled": {
-            "value": true
-          },
-          "livenessProbePath": {
-            "value": ""
-          },
-          "cpuCores": {
-            "value": 2
-          },
-          "memoryInGB": {
-            "value": "4Gi"
-          },
-          "minReplicas": {
-            "value": 0
-          },
-          "maxReplicas": {
-            "value": 3
-          },
-          "environmentVariables": {
-            "value": [
-              {
-                "name": "AZURE_APP_CONFIG_ENDPOINT",
-                "value": "[reference('appConfigStore').outputs.endpoint.value]"
-              },
-              {
-                "name": "APPLICATIONINSIGHTS_CONNECTION_STRING",
-                "value": "[if(not(empty(parameters('existingAppInsightsId'))), reference(parameters('existingAppInsightsId'), '2020-02-02').ConnectionString, if(variables('shouldCreateAppInsights'), reference('appInsights').outputs.connectionString.value, ''))]"
-              },
-              {
-                "name": "AZURE_CLIENT_ID",
-                "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
-              },
-              {
-                "name": "AZURE_STORAGE_ACCOUNT_NAME",
-                "value": "[variables('storageAccountName')]"
-              },
-              {
-                "name": "AZURE_CONTENT_UNDERSTANDING_ENDPOINT",
-                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
-              },
-              {
-                "name": "AZURE_OPENAI_ENDPOINT",
-                "value": "[format('https://{0}.services.ai.azure.com', reference('aiFoundry').outputs.aiServicesName.value)]"
-              }
-            ]
-          },
-          "tags": {
-            "value": "[union(variables('tags'), createObject('azd-service-name', 'worker'))]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "2552967140578694385"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Name of the container app"
-              }
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "Location for the container app"
-              }
-            },
-            "containerAppsEnvId": {
-              "type": "string",
-              "metadata": {
-                "description": "Container Apps Environment ID"
-              }
-            },
-            "containerRegistryServer": {
-              "type": "string",
-              "metadata": {
-                "description": "Container Registry server"
-              }
-            },
-            "managedIdentityId": {
-              "type": "string",
-              "metadata": {
-                "description": "Managed Identity Resource ID"
-              }
-            },
-            "targetPort": {
-              "type": "int",
-              "metadata": {
-                "description": "Target port for the container"
-              }
-            },
-            "externalIngress": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Enable external ingress. Defaults to true."
-              }
-            },
-            "corsEnabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Enable CORS. Defaults to true."
-              }
-            },
-            "cpuCores": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "CPU cores for the container. Defaults to 1."
-              }
-            },
-            "memoryInGB": {
-              "type": "string",
-              "defaultValue": "2Gi",
-              "metadata": {
-                "description": "Memory in GB for the container. Defaults to 2Gi."
-              }
-            },
-            "livenessProbePath": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Liveness probe path. Leave empty to disable liveness probe. Defaults to /health."
-              }
-            },
-            "minReplicas": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "Minimum number of replicas for scaling. Defaults to 1."
-              }
-            },
-            "maxReplicas": {
-              "type": "int",
-              "defaultValue": 2,
-              "metadata": {
-                "description": "Maximum number of replicas for scaling. Defaults to 2."
-              }
-            },
-            "environmentVariables": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Environment variables"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags to apply to resources"
-              }
-            },
-            "containerImage": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning)."
-              }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}.containerApp', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "environmentResourceId": {
-                    "value": "[parameters('containerAppsEnvId')]"
-                  },
-                  "corsPolicy": "[if(parameters('corsEnabled'), createObject('value', createObject('allowedOrigins', createArray('*'), 'allowedMethods', createArray('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'), 'allowedHeaders', createArray('*'), 'exposeHeaders', createArray('*'), 'maxAge', 3600, 'allowCredentials', true())), createObject('value', null()))]",
-                  "containers": {
-                    "value": [
-                      {
-                        "name": "[parameters('name')]",
-                        "image": "[if(not(empty(parameters('containerImage'))), parameters('containerImage'), 'mcr.microsoft.com/k8se/quickstart:latest')]",
-                        "resources": {
-                          "cpu": "[parameters('cpuCores')]",
-                          "memory": "[parameters('memoryInGB')]"
-                        },
-                        "env": "[parameters('environmentVariables')]",
-                        "probes": "[if(not(empty(parameters('livenessProbePath'))), createArray(createObject('type', 'Liveness', 'httpGet', createObject('path', parameters('livenessProbePath'), 'port', parameters('targetPort')), 'initialDelaySeconds', 5, 'periodSeconds', 60)), createArray())]"
-                      }
-                    ]
-                  },
-                  "ingressAllowInsecure": {
-                    "value": false
-                  },
-                  "ingressExternal": {
-                    "value": "[parameters('externalIngress')]"
-                  },
-                  "ingressTargetPort": {
-                    "value": "[parameters('targetPort')]"
-                  },
-                  "ingressTransport": {
-                    "value": "auto"
-                  },
-                  "activeRevisionsMode": {
-                    "value": "Single"
-                  },
-                  "managedIdentities": {
-                    "value": {
-                      "userAssignedResourceIds": [
-                        "[parameters('managedIdentityId')]"
-                      ]
-                    }
-                  },
-                  "registries": {
-                    "value": [
-                      {
-                        "server": "[parameters('containerRegistryServer')]",
-                        "identity": "[parameters('managedIdentityId')]"
-                      }
-                    ]
-                  },
-                  "scaleSettings": {
-                    "value": {
-                      "minReplicas": "[parameters('minReplicas')]",
-                      "maxReplicas": "[parameters('maxReplicas')]",
-                      "rules": "[if(greater(parameters('maxReplicas'), 1), createArray(createObject('name', 'http-scaler', 'http', createObject('metadata', createObject('concurrentRequests', '10')))), createArray())]"
-                    }
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.38.33.27573",
-                      "templateHash": "7056981135113238663"
-                    },
-                    "name": "Container Apps",
-                    "description": "This module deploys a Container App."
-                  },
-                  "definitions": {
-                    "ingressPortMappingType": {
-                      "type": "object",
-                      "properties": {
-                        "exposedPort": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
-                          }
-                        },
-                        "external": {
-                          "type": "bool",
-                          "metadata": {
-                            "description": "Required. Specifies whether the app port is accessible outside of the environment."
-                          }
-                        },
-                        "targetPort": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. Specifies the port the container listens on."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an ingress port mapping."
-                      }
-                    },
-                    "serviceBindingType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the service."
-                          }
-                        },
-                        "serviceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The service ID."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a service binding."
-                      }
-                    },
-                    "environmentVarType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Environment variable name."
-                          }
-                        },
-                        "secretRef": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
-                          }
-                        },
-                        "value": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Non-secret environment variable value."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an environment variable."
-                      }
-                    },
-                    "containerAppProbeType": {
-                      "type": "object",
-                      "properties": {
-                        "failureThreshold": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 10,
-                          "metadata": {
-                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
-                          }
-                        },
-                        "httpGet": {
-                          "$ref": "#/definitions/containerAppProbeHttpGetType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. HTTPGet specifies the http request to perform."
-                          }
-                        },
-                        "initialDelaySeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 60,
-                          "metadata": {
-                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
-                          }
-                        },
-                        "periodSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 240,
-                          "metadata": {
-                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
-                          }
-                        },
-                        "successThreshold": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 10,
-                          "metadata": {
-                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
-                          }
-                        },
-                        "tcpSocket": {
-                          "$ref": "#/definitions/containerAppProbeTcpSocketType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
-                          }
-                        },
-                        "terminationGracePeriodSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
-                          }
-                        },
-                        "timeoutSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 240,
-                          "metadata": {
-                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
-                          }
-                        },
-                        "type": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Liveness",
-                            "Readiness",
-                            "Startup"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The type of probe."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe."
-                      }
-                    },
-                    "corsPolicyType": {
-                      "type": "object",
-                      "properties": {
-                        "allowCredentials": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Switch to determine whether the resource allows credentials."
-                          }
-                        },
-                        "allowedHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-headers header."
-                          }
-                        },
-                        "allowedMethods": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-methods header."
-                          }
-                        },
-                        "allowedOrigins": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-origins header."
-                          }
-                        },
-                        "exposeHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-expose-headers header."
-                          }
-                        },
-                        "maxAge": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-max-age header."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a CORS policy."
-                      }
-                    },
-                    "containerAppProbeHttpGetType": {
-                      "type": "object",
-                      "properties": {
-                        "host": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
-                          }
-                        },
-                        "httpHeaders": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. HTTP headers to set in the request."
-                          }
-                        },
-                        "path": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Path to access on the HTTP server."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. Name or number of the port to access on the container."
-                          }
-                        },
-                        "scheme": {
-                          "type": "string",
-                          "allowedValues": [
-                            "HTTP",
-                            "HTTPS"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe HTTP GET."
-                      }
-                    },
-                    "containerAppProbeHttpGetHeadersItemType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the header."
-                          }
-                        },
-                        "value": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Value of the header."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe HTTP GET header."
-                      }
-                    },
-                    "containerAppProbeTcpSocketType": {
-                      "type": "object",
-                      "properties": {
-                        "host": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Host name to connect to, defaults to the pod IP."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "minValue": 1,
-                          "maxValue": 65535,
-                          "metadata": {
-                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe TCP socket."
-                      }
-                    },
-                    "scaleType": {
-                      "type": "object",
-                      "properties": {
-                        "maxReplicas": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The maximum number of replicas."
-                          }
-                        },
-                        "minReplicas": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The minimum number of replicas."
-                          }
-                        },
-                        "cooldownPeriod": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The cooldown period in seconds."
-                          }
-                        },
-                        "pollingInterval": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The polling interval in seconds."
-                          }
-                        },
-                        "rules": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/scaleRuleType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The scaling rules."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The scale settings for the Container App."
-                      }
-                    },
-                    "scaleRuleType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the scaling rule."
-                          }
-                        },
-                        "custom": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom scaling rule."
-                          }
-                        },
-                        "azureQueue": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Azure Queue based scaling rule."
-                          }
-                        },
-                        "http": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The HTTP requests based scaling rule."
-                          }
-                        },
-                        "tcp": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The TCP based scaling rule."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The scaling rules for the Container App."
-                      }
-                    },
-                    "volumeMountType": {
-                      "type": "object",
-                      "properties": {
-                        "mountPath": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
-                          }
-                        },
-                        "subPath": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
-                          }
-                        },
-                        "volumeName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. This must match the Name of a Volume."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a volume mount."
-                      }
-                    },
-                    "secretType": {
-                      "type": "object",
-                      "properties": {
-                        "identity": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
-                          }
-                        },
-                        "keyVaultUrl": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
-                          }
-                        },
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the container app secret."
-                          }
-                        },
-                        "value": {
-                          "type": "securestring",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a secret."
-                      }
-                    },
-                    "authConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "encryptionSettings": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
-                            },
-                            "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "globalValidation": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
-                            },
-                            "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "httpSettings": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
-                            },
-                            "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "identityProviders": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
-                            },
-                            "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "login": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
-                            },
-                            "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "platform": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
-                            },
-                            "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the container app's authentication configuration."
-                      }
-                    },
-                    "diagnosticSettingMetricsOnlyType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of diagnostic setting."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Container App."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "defaultValue": "containerapps",
-                      "allowedValues": [
-                        "containerapps",
-                        "workflowapp",
-                        "functionapp"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Metadata used to render different experiences for resources of the same type."
-                      }
-                    },
-                    "disableIngress": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Bool to disable all ingress traffic for the container app."
-                      }
-                    },
-                    "ingressExternal": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
-                      }
-                    },
-                    "clientCertificateMode": {
-                      "type": "string",
-                      "defaultValue": "ignore",
-                      "allowedValues": [
-                        "accept",
-                        "ignore",
-                        "require"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Client certificate mode for mTLS."
-                      }
-                    },
-                    "corsPolicy": {
-                      "$ref": "#/definitions/corsPolicyType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Object userd to configure CORS policy."
-                      }
-                    },
-                    "stickySessionsAffinity": {
-                      "type": "string",
-                      "defaultValue": "none",
-                      "allowedValues": [
-                        "none",
-                        "sticky"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
-                      }
-                    },
-                    "ingressTransport": {
-                      "type": "string",
-                      "defaultValue": "auto",
-                      "allowedValues": [
-                        "auto",
-                        "http",
-                        "http2",
-                        "tcp"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Ingress transport protocol."
-                      }
-                    },
-                    "service": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/service"
-                        },
-                        "description": "Optional. Dev ContainerApp service type."
-                      },
-                      "nullable": true
-                    },
-                    "includeAddOns": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Toggle to include the service configuration."
-                      }
-                    },
-                    "additionalPortMappings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ingressPortMappingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Settings to expose additional ports on container app."
-                      }
-                    },
-                    "ingressAllowInsecure": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
-                      }
-                    },
-                    "ingressTargetPort": {
-                      "type": "int",
-                      "defaultValue": 80,
-                      "metadata": {
-                        "description": "Optional. Target Port in containers for traffic from ingress."
-                      }
-                    },
-                    "scaleSettings": {
-                      "$ref": "#/definitions/scaleType",
-                      "defaultValue": {
-                        "maxReplicas": 10,
-                        "minReplicas": 3
-                      },
-                      "metadata": {
-                        "description": "Optional. The scaling settings of the service."
-                      }
-                    },
-                    "serviceBinds": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/serviceBindingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. List of container app services bound to the app."
-                      }
-                    },
-                    "activeRevisionsMode": {
-                      "type": "string",
-                      "defaultValue": "Single",
-                      "allowedValues": [
-                        "Multiple",
-                        "Single"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Controls how active revisions are handled for the Container app."
-                      }
-                    },
-                    "environmentResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of environment."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "registries": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/registries"
-                        },
-                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
-                      },
-                      "nullable": true
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "customDomains": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/customDomains"
-                        },
-                        "description": "Optional. Custom domain bindings for Container App hostnames."
-                      },
-                      "nullable": true
-                    },
-                    "exposedPort": {
-                      "type": "int",
-                      "defaultValue": 0,
-                      "metadata": {
-                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
-                      }
-                    },
-                    "ipSecurityRestrictions": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/ipSecurityRestrictions"
-                        },
-                        "description": "Optional. Rules to restrict incoming IP address."
-                      },
-                      "nullable": true
-                    },
-                    "trafficLabel": {
-                      "type": "string",
-                      "defaultValue": "label-1",
-                      "metadata": {
-                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
-                      }
-                    },
-                    "trafficLatestRevision": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
-                      }
-                    },
-                    "trafficRevisionName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Name of a revision."
-                      }
-                    },
-                    "trafficWeight": {
-                      "type": "int",
-                      "defaultValue": 100,
-                      "metadata": {
-                        "description": "Optional. Traffic weight assigned to a revision."
-                      }
-                    },
-                    "dapr": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/dapr"
-                        },
-                        "description": "Optional. Dapr configuration for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "identitySettings": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/identitySettings"
-                        },
-                        "description": "Optional. Settings for Managed Identities that are assigned to the Container App. If a Managed Identity is not specified here, default settings will be used."
-                      },
-                      "nullable": true
-                    },
-                    "maxInactiveRevisions": {
-                      "type": "int",
-                      "defaultValue": 0,
-                      "metadata": {
-                        "description": "Optional. Max inactive revisions a Container App can have."
-                      }
-                    },
-                    "runtime": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/runtime"
-                        },
-                        "description": "Optional. Runtime configuration for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "containers": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/containers"
-                        },
-                        "description": "Required. List of container definitions for the Container App."
-                      }
-                    },
-                    "terminationGracePeriodSeconds": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The termination grace period for the container app."
-                      }
-                    },
-                    "initContainersTemplate": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/initContainers"
-                        },
-                        "description": "Optional. List of specialized containers that run before app containers."
-                      },
-                      "nullable": true
-                    },
-                    "secrets": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The secrets of the Container App."
-                      }
-                    },
-                    "revisionSuffix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. User friendly suffix that is appended to the revision name."
-                      }
-                    },
-                    "volumes": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/volumes"
-                        },
-                        "description": "Optional. List of volume definitions for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "workloadProfileName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Workload profile name to pin for container app execution."
-                      }
-                    },
-                    "authConfig": {
-                      "$ref": "#/definitions/authConfigType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The name of the Container App Auth configs."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "containerApp": {
-                      "type": "Microsoft.App/containerApps",
-                      "apiVersion": "2025-02-02-preview",
-                      "name": "[parameters('name')]",
-                      "tags": "[parameters('tags')]",
-                      "kind": "[parameters('kind')]",
-                      "location": "[parameters('location')]",
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "environmentId": "[parameters('environmentResourceId')]",
-                        "workloadProfileName": "[parameters('workloadProfileName')]",
-                        "template": {
-                          "containers": "[parameters('containers')]",
-                          "terminationGracePeriodSeconds": "[parameters('terminationGracePeriodSeconds')]",
-                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
-                          "revisionSuffix": "[parameters('revisionSuffix')]",
-                          "scale": "[parameters('scaleSettings')]",
-                          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
-                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
-                        },
-                        "configuration": {
-                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
-                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
-                          "identitySettings": "[if(not(empty(parameters('identitySettings'))), parameters('identitySettings'), null())]",
-                          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
-                          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
-                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
-                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
-                          "secrets": "[parameters('secrets')]",
-                          "runtime": "[if(not(empty(parameters('runtime'))), parameters('runtime'), null())]"
-                        }
-                      }
-                    },
-                    "containerApp_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerApp_roleAssignments": {
-                      "copy": {
-                        "name": "containerApp_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerApp_diagnosticSettings": {
-                      "copy": {
-                        "name": "containerApp_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerAppAuthConfigs": {
-                      "condition": "[not(empty(parameters('authConfig')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[format('{0}-auth-config', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "containerAppName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "encryptionSettings": {
-                            "value": "[tryGet(parameters('authConfig'), 'encryptionSettings')]"
-                          },
-                          "globalValidation": {
-                            "value": "[tryGet(parameters('authConfig'), 'globalValidation')]"
-                          },
-                          "httpSettings": {
-                            "value": "[tryGet(parameters('authConfig'), 'httpSettings')]"
-                          },
-                          "identityProviders": {
-                            "value": "[tryGet(parameters('authConfig'), 'identityProviders')]"
-                          },
-                          "login": {
-                            "value": "[tryGet(parameters('authConfig'), 'login')]"
-                          },
-                          "platform": {
-                            "value": "[tryGet(parameters('authConfig'), 'platform')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "12480411243596309951"
-                            },
-                            "name": "Container App Auth Configs",
-                            "description": "This module deploys Container App Auth Configs."
-                          },
-                          "parameters": {
-                            "containerAppName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Container App. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "encryptionSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
-                                },
-                                "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "globalValidation": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
-                                },
-                                "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "httpSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
-                                },
-                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "identityProviders": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
-                                },
-                                "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "login": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
-                                },
-                                "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "platform": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
-                                },
-                                "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "resources": {
-                            "containerApp": {
-                              "existing": true,
-                              "type": "Microsoft.App/containerApps",
-                              "apiVersion": "2025-02-02-preview",
-                              "name": "[parameters('containerAppName')]"
-                            },
-                            "containerAppAuthConfigs": {
-                              "type": "Microsoft.App/containerApps/authConfigs",
-                              "apiVersion": "2025-02-02-preview",
-                              "name": "[format('{0}/{1}', parameters('containerAppName'), 'current')]",
-                              "properties": {
-                                "encryptionSettings": "[parameters('encryptionSettings')]",
-                                "globalValidation": "[parameters('globalValidation')]",
-                                "httpSettings": "[parameters('httpSettings')]",
-                                "identityProviders": "[parameters('identityProviders')]",
-                                "login": "[parameters('login')]",
-                                "platform": "[parameters('platform')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the set of Container App Auth configs."
-                              },
-                              "value": "current"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the set of Container App Auth configs."
-                              },
-                              "value": "[resourceId('Microsoft.App/containerApps/authConfigs', parameters('containerAppName'), 'current')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group containing the set of Container App Auth configs."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Container App."
-                      },
-                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
-                    },
-                    "fqdn": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The configuration of ingress fqdn."
-                      },
-                      "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the Container App was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Container App."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('containerApp', '2025-02-02-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('containerApp', '2025-02-02-preview', 'full').location]"
-                    }
-                  }
-                }
-              }
-            }
-          ],
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.resourceId.value]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[format('{0}.containerApp', deployment().name)]"
-            },
-            "fqdn": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.fqdn.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "aiFoundry",
-        "appConfigStore",
-        "appInsights",
-        "containerAppsEnvironment",
-        "containerRegistry",
-        "userAssignedIdentity"
-      ]
-    },
-    "webContainerApp": {
-      "type": "Microsoft.Resources/deployments",
-      "apiVersion": "2025-04-01",
-      "name": "[format('ca-web-{0}', variables('resourceToken'))]",
-      "properties": {
-        "expressionEvaluationOptions": {
-          "scope": "inner"
-        },
-        "mode": "Incremental",
-        "parameters": {
-          "name": {
-            "value": "[variables('webContainerAppName')]"
-          },
-          "location": {
-            "value": "[reference('containerAppsEnvironment').outputs.location.value]"
-          },
-          "containerAppsEnvId": {
-            "value": "[reference('containerAppsEnvironment').outputs.resourceId.value]"
-          },
-          "containerRegistryServer": {
-            "value": "[reference('containerRegistry').outputs.loginServer.value]"
-          },
-          "managedIdentityId": {
-            "value": "[reference('userAssignedIdentity').outputs.resourceId.value]"
-          },
-          "targetPort": {
-            "value": 8080
-          },
-          "externalIngress": {
-            "value": true
-          },
-          "corsEnabled": {
-            "value": true
-          },
-          "livenessProbePath": {
-            "value": ""
-          },
-          "cpuCores": {
-            "value": 1
-          },
-          "memoryInGB": {
-            "value": "2Gi"
-          },
-          "minReplicas": {
-            "value": 0
-          },
-          "maxReplicas": {
-            "value": 1
-          },
-          "environmentVariables": {
-            "value": [
-              {
-                "name": "VITE_API_BASE_URL",
-                "value": "[format('https://{0}/api/', reference('apiContainerApp').outputs.fqdn.value)]"
-              }
-            ]
-          },
-          "tags": {
-            "value": "[union(variables('tags'), createObject('azd-service-name', 'web'))]"
-          }
-        },
-        "template": {
-          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-          "contentVersion": "1.0.0.0",
-          "metadata": {
-            "_generator": {
-              "name": "bicep",
-              "version": "0.43.8.12551",
-              "templateHash": "2552967140578694385"
-            }
-          },
-          "parameters": {
-            "name": {
-              "type": "string",
-              "metadata": {
-                "description": "Name of the container app"
-              }
-            },
-            "location": {
-              "type": "string",
-              "metadata": {
-                "description": "Location for the container app"
-              }
-            },
-            "containerAppsEnvId": {
-              "type": "string",
-              "metadata": {
-                "description": "Container Apps Environment ID"
-              }
-            },
-            "containerRegistryServer": {
-              "type": "string",
-              "metadata": {
-                "description": "Container Registry server"
-              }
-            },
-            "managedIdentityId": {
-              "type": "string",
-              "metadata": {
-                "description": "Managed Identity Resource ID"
-              }
-            },
-            "targetPort": {
-              "type": "int",
-              "metadata": {
-                "description": "Target port for the container"
-              }
-            },
-            "externalIngress": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Enable external ingress. Defaults to true."
-              }
-            },
-            "corsEnabled": {
-              "type": "bool",
-              "defaultValue": true,
-              "metadata": {
-                "description": "Enable CORS. Defaults to true."
-              }
-            },
-            "cpuCores": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "CPU cores for the container. Defaults to 1."
-              }
-            },
-            "memoryInGB": {
-              "type": "string",
-              "defaultValue": "2Gi",
-              "metadata": {
-                "description": "Memory in GB for the container. Defaults to 2Gi."
-              }
-            },
-            "livenessProbePath": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Liveness probe path. Leave empty to disable liveness probe. Defaults to /health."
-              }
-            },
-            "minReplicas": {
-              "type": "int",
-              "defaultValue": 1,
-              "metadata": {
-                "description": "Minimum number of replicas for scaling. Defaults to 1."
-              }
-            },
-            "maxReplicas": {
-              "type": "int",
-              "defaultValue": 2,
-              "metadata": {
-                "description": "Maximum number of replicas for scaling. Defaults to 2."
-              }
-            },
-            "environmentVariables": {
-              "type": "array",
-              "defaultValue": [],
-              "metadata": {
-                "description": "Environment variables"
-              }
-            },
-            "tags": {
-              "type": "object",
-              "defaultValue": {},
-              "metadata": {
-                "description": "Tags to apply to resources"
-              }
-            },
-            "containerImage": {
-              "type": "string",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Container image to use. Defaults to MCR quickstart (no ACR dependency during provisioning)."
-              }
-            }
-          },
-          "resources": [
-            {
-              "type": "Microsoft.Resources/deployments",
-              "apiVersion": "2025-04-01",
-              "name": "[format('{0}.containerApp', deployment().name)]",
-              "properties": {
-                "expressionEvaluationOptions": {
-                  "scope": "inner"
-                },
-                "mode": "Incremental",
-                "parameters": {
-                  "name": {
-                    "value": "[parameters('name')]"
-                  },
-                  "location": {
-                    "value": "[parameters('location')]"
-                  },
-                  "tags": {
-                    "value": "[parameters('tags')]"
-                  },
-                  "environmentResourceId": {
-                    "value": "[parameters('containerAppsEnvId')]"
-                  },
-                  "corsPolicy": "[if(parameters('corsEnabled'), createObject('value', createObject('allowedOrigins', createArray('*'), 'allowedMethods', createArray('GET', 'POST', 'PUT', 'DELETE', 'OPTIONS', 'PATCH'), 'allowedHeaders', createArray('*'), 'exposeHeaders', createArray('*'), 'maxAge', 3600, 'allowCredentials', true())), createObject('value', null()))]",
-                  "containers": {
-                    "value": [
-                      {
-                        "name": "[parameters('name')]",
-                        "image": "[if(not(empty(parameters('containerImage'))), parameters('containerImage'), 'mcr.microsoft.com/k8se/quickstart:latest')]",
-                        "resources": {
-                          "cpu": "[parameters('cpuCores')]",
-                          "memory": "[parameters('memoryInGB')]"
-                        },
-                        "env": "[parameters('environmentVariables')]",
-                        "probes": "[if(not(empty(parameters('livenessProbePath'))), createArray(createObject('type', 'Liveness', 'httpGet', createObject('path', parameters('livenessProbePath'), 'port', parameters('targetPort')), 'initialDelaySeconds', 5, 'periodSeconds', 60)), createArray())]"
-                      }
-                    ]
-                  },
-                  "ingressAllowInsecure": {
-                    "value": false
-                  },
-                  "ingressExternal": {
-                    "value": "[parameters('externalIngress')]"
-                  },
-                  "ingressTargetPort": {
-                    "value": "[parameters('targetPort')]"
-                  },
-                  "ingressTransport": {
-                    "value": "auto"
-                  },
-                  "activeRevisionsMode": {
-                    "value": "Single"
-                  },
-                  "managedIdentities": {
-                    "value": {
-                      "userAssignedResourceIds": [
-                        "[parameters('managedIdentityId')]"
-                      ]
-                    }
-                  },
-                  "registries": {
-                    "value": [
-                      {
-                        "server": "[parameters('containerRegistryServer')]",
-                        "identity": "[parameters('managedIdentityId')]"
-                      }
-                    ]
-                  },
-                  "scaleSettings": {
-                    "value": {
-                      "minReplicas": "[parameters('minReplicas')]",
-                      "maxReplicas": "[parameters('maxReplicas')]",
-                      "rules": "[if(greater(parameters('maxReplicas'), 1), createArray(createObject('name', 'http-scaler', 'http', createObject('metadata', createObject('concurrentRequests', '10')))), createArray())]"
-                    }
-                  }
-                },
-                "template": {
-                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                  "languageVersion": "2.0",
-                  "contentVersion": "1.0.0.0",
-                  "metadata": {
-                    "_generator": {
-                      "name": "bicep",
-                      "version": "0.38.33.27573",
-                      "templateHash": "7056981135113238663"
-                    },
-                    "name": "Container Apps",
-                    "description": "This module deploys a Container App."
-                  },
-                  "definitions": {
-                    "ingressPortMappingType": {
-                      "type": "object",
-                      "properties": {
-                        "exposedPort": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the exposed port for the target port. If not specified, it defaults to target port."
-                          }
-                        },
-                        "external": {
-                          "type": "bool",
-                          "metadata": {
-                            "description": "Required. Specifies whether the app port is accessible outside of the environment."
-                          }
-                        },
-                        "targetPort": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. Specifies the port the container listens on."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an ingress port mapping."
-                      }
-                    },
-                    "serviceBindingType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the service."
-                          }
-                        },
-                        "serviceId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The service ID."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a service binding."
-                      }
-                    },
-                    "environmentVarType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Environment variable name."
-                          }
-                        },
-                        "secretRef": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the Container App secret from which to pull the environment variable value."
-                          }
-                        },
-                        "value": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Non-secret environment variable value."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for an environment variable."
-                      }
-                    },
-                    "containerAppProbeType": {
-                      "type": "object",
-                      "properties": {
-                        "failureThreshold": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 10,
-                          "metadata": {
-                            "description": "Optional. Minimum consecutive failures for the probe to be considered failed after having succeeded. Defaults to 3."
-                          }
-                        },
-                        "httpGet": {
-                          "$ref": "#/definitions/containerAppProbeHttpGetType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. HTTPGet specifies the http request to perform."
-                          }
-                        },
-                        "initialDelaySeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 60,
-                          "metadata": {
-                            "description": "Optional. Number of seconds after the container has started before liveness probes are initiated."
-                          }
-                        },
-                        "periodSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 240,
-                          "metadata": {
-                            "description": "Optional. How often (in seconds) to perform the probe. Default to 10 seconds."
-                          }
-                        },
-                        "successThreshold": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 10,
-                          "metadata": {
-                            "description": "Optional. Minimum consecutive successes for the probe to be considered successful after having failed. Defaults to 1. Must be 1 for liveness and startup."
-                          }
-                        },
-                        "tcpSocket": {
-                          "$ref": "#/definitions/containerAppProbeTcpSocketType",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The TCP socket specifies an action involving a TCP port. TCP hooks not yet supported."
-                          }
-                        },
-                        "terminationGracePeriodSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Optional duration in seconds the pod needs to terminate gracefully upon probe failure. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. If this value is nil, the pod's terminationGracePeriodSeconds will be used. Otherwise, this value overrides the value provided by the pod spec. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). This is an alpha field and requires enabling ProbeTerminationGracePeriod feature gate. Maximum value is 3600 seconds (1 hour)."
-                          }
-                        },
-                        "timeoutSeconds": {
-                          "type": "int",
-                          "nullable": true,
-                          "minValue": 1,
-                          "maxValue": 240,
-                          "metadata": {
-                            "description": "Optional. Number of seconds after which the probe times out. Defaults to 1 second."
-                          }
-                        },
-                        "type": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Liveness",
-                            "Readiness",
-                            "Startup"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The type of probe."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe."
-                      }
-                    },
-                    "corsPolicyType": {
-                      "type": "object",
-                      "properties": {
-                        "allowCredentials": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Switch to determine whether the resource allows credentials."
-                          }
-                        },
-                        "allowedHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-headers header."
-                          }
-                        },
-                        "allowedMethods": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-methods header."
-                          }
-                        },
-                        "allowedOrigins": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-allow-origins header."
-                          }
-                        },
-                        "exposeHeaders": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-expose-headers header."
-                          }
-                        },
-                        "maxAge": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specifies the content for the access-control-max-age header."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a CORS policy."
-                      }
-                    },
-                    "containerAppProbeHttpGetType": {
-                      "type": "object",
-                      "properties": {
-                        "host": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Host name to connect to. Defaults to the pod IP."
-                          }
-                        },
-                        "httpHeaders": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/containerAppProbeHttpGetHeadersItemType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. HTTP headers to set in the request."
-                          }
-                        },
-                        "path": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Path to access on the HTTP server."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. Name or number of the port to access on the container."
-                          }
-                        },
-                        "scheme": {
-                          "type": "string",
-                          "allowedValues": [
-                            "HTTP",
-                            "HTTPS"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Scheme to use for connecting to the host. Defaults to HTTP."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe HTTP GET."
-                      }
-                    },
-                    "containerAppProbeHttpGetHeadersItemType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Name of the header."
-                          }
-                        },
-                        "value": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Value of the header."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe HTTP GET header."
-                      }
-                    },
-                    "containerAppProbeTcpSocketType": {
-                      "type": "object",
-                      "properties": {
-                        "host": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Host name to connect to, defaults to the pod IP."
-                          }
-                        },
-                        "port": {
-                          "type": "int",
-                          "minValue": 1,
-                          "maxValue": 65535,
-                          "metadata": {
-                            "description": "Required. Number of the port to access on the container. Name must be an IANA_SVC_NAME."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a container app probe TCP socket."
-                      }
-                    },
-                    "scaleType": {
-                      "type": "object",
-                      "properties": {
-                        "maxReplicas": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The maximum number of replicas."
-                          }
-                        },
-                        "minReplicas": {
-                          "type": "int",
-                          "metadata": {
-                            "description": "Required. The minimum number of replicas."
-                          }
-                        },
-                        "cooldownPeriod": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The cooldown period in seconds."
-                          }
-                        },
-                        "pollingInterval": {
-                          "type": "int",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The polling interval in seconds."
-                          }
-                        },
-                        "rules": {
-                          "type": "array",
-                          "items": {
-                            "$ref": "#/definitions/scaleRuleType"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The scaling rules."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The scale settings for the Container App."
-                      }
-                    },
-                    "scaleRuleType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The name of the scaling rule."
-                          }
-                        },
-                        "custom": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The custom scaling rule."
-                          }
-                        },
-                        "azureQueue": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Azure Queue based scaling rule."
-                          }
-                        },
-                        "http": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The HTTP requests based scaling rule."
-                          }
-                        },
-                        "tcp": {
-                          "type": "object",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The TCP based scaling rule."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The scaling rules for the Container App."
-                      }
-                    },
-                    "volumeMountType": {
-                      "type": "object",
-                      "properties": {
-                        "mountPath": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. Path within the container at which the volume should be mounted.Must not contain ':'."
-                          }
-                        },
-                        "subPath": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Path within the volume from which the container's volume should be mounted. Defaults to \"\" (volume's root)."
-                          }
-                        },
-                        "volumeName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. This must match the Name of a Volume."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "The type for a volume mount."
-                      }
-                    },
-                    "secretType": {
-                      "type": "object",
-                      "properties": {
-                        "identity": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of a managed identity to authenticate with Azure Key Vault, or System to use a system-assigned identity."
-                          }
-                        },
-                        "keyVaultUrl": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The URL of the Azure Key Vault secret referenced by the Container App. Required if `value` is null."
-                          }
-                        },
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of the container app secret."
-                          }
-                        },
-                        "value": {
-                          "type": "securestring",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Conditional. The container app secret value, if not fetched from the Key Vault. Required if `keyVaultUrl` is not null."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for a secret."
-                      }
-                    },
-                    "authConfigType": {
-                      "type": "object",
-                      "properties": {
-                        "encryptionSettings": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
-                            },
-                            "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "globalValidation": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
-                            },
-                            "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "httpSettings": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
-                            },
-                            "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "identityProviders": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
-                            },
-                            "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "login": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
-                            },
-                            "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        },
-                        "platform": {
-                          "type": "object",
-                          "metadata": {
-                            "__bicep_resource_derived_type!": {
-                              "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
-                            },
-                            "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
-                          },
-                          "nullable": true
-                        }
-                      },
-                      "metadata": {
-                        "__bicep_export!": true,
-                        "description": "The type for the container app's authentication configuration."
-                      }
-                    },
-                    "diagnosticSettingMetricsOnlyType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of diagnostic setting."
-                          }
-                        },
-                        "metricCategories": {
-                          "type": "array",
-                          "items": {
-                            "type": "object",
-                            "properties": {
-                              "category": {
-                                "type": "string",
-                                "metadata": {
-                                  "description": "Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to `AllMetrics` to collect all metrics."
-                                }
-                              },
-                              "enabled": {
-                                "type": "bool",
-                                "nullable": true,
-                                "metadata": {
-                                  "description": "Optional. Enable or disable the category explicitly. Default is `true`."
-                                }
-                              }
-                            }
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name of metrics that will be streamed. \"allMetrics\" includes all possible metrics for the resource. Set to `[]` to disable metric collection."
-                          }
-                        },
-                        "logAnalyticsDestinationType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "AzureDiagnostics",
-                            "Dedicated"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type."
-                          }
-                        },
-                        "workspaceResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "storageAccountResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "eventHubAuthorizationRuleResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to."
-                          }
-                        },
-                        "eventHubName": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub."
-                          }
-                        },
-                        "marketplacePartnerResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a diagnostic setting. To be used if only metrics are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "lockType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the name of lock."
-                          }
-                        },
-                        "kind": {
-                          "type": "string",
-                          "allowedValues": [
-                            "CanNotDelete",
-                            "None",
-                            "ReadOnly"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the type of lock."
-                          }
-                        },
-                        "notes": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Specify the notes of the lock."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a lock.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.6.0"
-                        }
-                      }
-                    },
-                    "managedIdentityAllType": {
-                      "type": "object",
-                      "properties": {
-                        "systemAssigned": {
-                          "type": "bool",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Enables system assigned managed identity on the resource."
-                          }
-                        },
-                        "userAssignedResourceIds": {
-                          "type": "array",
-                          "items": {
-                            "type": "string"
-                          },
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The resource ID(s) to assign to the resource. Required if a user assigned identity is used for encryption."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a managed identity configuration. To be used if both a system-assigned & user-assigned identities are supported by the resource provider.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                        }
-                      }
-                    },
-                    "roleAssignmentType": {
-                      "type": "object",
-                      "properties": {
-                        "name": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The name (as GUID) of the role assignment. If not provided, a GUID will be generated."
-                          }
-                        },
-                        "roleDefinitionIdOrName": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'."
-                          }
-                        },
-                        "principalId": {
-                          "type": "string",
-                          "metadata": {
-                            "description": "Required. The principal ID of the principal (user/group/identity) to assign the role to."
-                          }
-                        },
-                        "principalType": {
-                          "type": "string",
-                          "allowedValues": [
-                            "Device",
-                            "ForeignGroup",
-                            "Group",
-                            "ServicePrincipal",
-                            "User"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The principal type of the assigned principal ID."
-                          }
-                        },
-                        "description": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The description of the role assignment."
-                          }
-                        },
-                        "condition": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase \"foo_storage_container\"."
-                          }
-                        },
-                        "conditionVersion": {
-                          "type": "string",
-                          "allowedValues": [
-                            "2.0"
-                          ],
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. Version of the condition."
-                          }
-                        },
-                        "delegatedManagedIdentityResourceId": {
-                          "type": "string",
-                          "nullable": true,
-                          "metadata": {
-                            "description": "Optional. The Resource Id of the delegated managed identity resource."
-                          }
-                        }
-                      },
-                      "metadata": {
-                        "description": "An AVM-aligned type for a role assignment.",
-                        "__bicep_imported_from!": {
-                          "sourceTemplate": "br:mcr.microsoft.com/bicep/avm/utl/types/avm-common-types:0.4.1"
-                        }
-                      }
-                    }
-                  },
-                  "parameters": {
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Name of the Container App."
-                      }
-                    },
-                    "location": {
-                      "type": "string",
-                      "defaultValue": "[resourceGroup().location]",
-                      "metadata": {
-                        "description": "Optional. Location for all Resources."
-                      }
-                    },
-                    "kind": {
-                      "type": "string",
-                      "defaultValue": "containerapps",
-                      "allowedValues": [
-                        "containerapps",
-                        "workflowapp",
-                        "functionapp"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Metadata used to render different experiences for resources of the same type."
-                      }
-                    },
-                    "disableIngress": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Bool to disable all ingress traffic for the container app."
-                      }
-                    },
-                    "ingressExternal": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Bool indicating if the App exposes an external HTTP endpoint."
-                      }
-                    },
-                    "clientCertificateMode": {
-                      "type": "string",
-                      "defaultValue": "ignore",
-                      "allowedValues": [
-                        "accept",
-                        "ignore",
-                        "require"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Client certificate mode for mTLS."
-                      }
-                    },
-                    "corsPolicy": {
-                      "$ref": "#/definitions/corsPolicyType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Object userd to configure CORS policy."
-                      }
-                    },
-                    "stickySessionsAffinity": {
-                      "type": "string",
-                      "defaultValue": "none",
-                      "allowedValues": [
-                        "none",
-                        "sticky"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Bool indicating if the Container App should enable session affinity."
-                      }
-                    },
-                    "ingressTransport": {
-                      "type": "string",
-                      "defaultValue": "auto",
-                      "allowedValues": [
-                        "auto",
-                        "http",
-                        "http2",
-                        "tcp"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Ingress transport protocol."
-                      }
-                    },
-                    "service": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/service"
-                        },
-                        "description": "Optional. Dev ContainerApp service type."
-                      },
-                      "nullable": true
-                    },
-                    "includeAddOns": {
-                      "type": "bool",
-                      "defaultValue": false,
-                      "metadata": {
-                        "description": "Optional. Toggle to include the service configuration."
-                      }
-                    },
-                    "additionalPortMappings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/ingressPortMappingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Settings to expose additional ports on container app."
-                      }
-                    },
-                    "ingressAllowInsecure": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Bool indicating if HTTP connections to is allowed. If set to false HTTP connections are automatically redirected to HTTPS connections."
-                      }
-                    },
-                    "ingressTargetPort": {
-                      "type": "int",
-                      "defaultValue": 80,
-                      "metadata": {
-                        "description": "Optional. Target Port in containers for traffic from ingress."
-                      }
-                    },
-                    "scaleSettings": {
-                      "$ref": "#/definitions/scaleType",
-                      "defaultValue": {
-                        "maxReplicas": 10,
-                        "minReplicas": 3
-                      },
-                      "metadata": {
-                        "description": "Optional. The scaling settings of the service."
-                      }
-                    },
-                    "serviceBinds": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/serviceBindingType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. List of container app services bound to the app."
-                      }
-                    },
-                    "activeRevisionsMode": {
-                      "type": "string",
-                      "defaultValue": "Single",
-                      "allowedValues": [
-                        "Multiple",
-                        "Single"
-                      ],
-                      "metadata": {
-                        "description": "Optional. Controls how active revisions are handled for the Container app."
-                      }
-                    },
-                    "environmentResourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "Required. Resource ID of environment."
-                      }
-                    },
-                    "lock": {
-                      "$ref": "#/definitions/lockType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The lock settings of the service."
-                      }
-                    },
-                    "tags": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/tags"
-                        },
-                        "description": "Optional. Tags of the resource."
-                      },
-                      "nullable": true
-                    },
-                    "registries": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/registries"
-                        },
-                        "description": "Optional. Collection of private container registry credentials for containers used by the Container app."
-                      },
-                      "nullable": true
-                    },
-                    "managedIdentities": {
-                      "$ref": "#/definitions/managedIdentityAllType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The managed identity definition for this resource."
-                      }
-                    },
-                    "roleAssignments": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/roleAssignmentType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Array of role assignments to create."
-                      }
-                    },
-                    "enableTelemetry": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Enable/Disable usage telemetry for module."
-                      }
-                    },
-                    "customDomains": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/customDomains"
-                        },
-                        "description": "Optional. Custom domain bindings for Container App hostnames."
-                      },
-                      "nullable": true
-                    },
-                    "exposedPort": {
-                      "type": "int",
-                      "defaultValue": 0,
-                      "metadata": {
-                        "description": "Optional. Exposed Port in containers for TCP traffic from ingress."
-                      }
-                    },
-                    "ipSecurityRestrictions": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/ingress/properties/ipSecurityRestrictions"
-                        },
-                        "description": "Optional. Rules to restrict incoming IP address."
-                      },
-                      "nullable": true
-                    },
-                    "trafficLabel": {
-                      "type": "string",
-                      "defaultValue": "label-1",
-                      "metadata": {
-                        "description": "Optional. Associates a traffic label with a revision. Label name should be consist of lower case alphanumeric characters or dashes."
-                      }
-                    },
-                    "trafficLatestRevision": {
-                      "type": "bool",
-                      "defaultValue": true,
-                      "metadata": {
-                        "description": "Optional. Indicates that the traffic weight belongs to a latest stable revision."
-                      }
-                    },
-                    "trafficRevisionName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Name of a revision."
-                      }
-                    },
-                    "trafficWeight": {
-                      "type": "int",
-                      "defaultValue": 100,
-                      "metadata": {
-                        "description": "Optional. Traffic weight assigned to a revision."
-                      }
-                    },
-                    "dapr": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/dapr"
-                        },
-                        "description": "Optional. Dapr configuration for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "identitySettings": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/identitySettings"
-                        },
-                        "description": "Optional. Settings for Managed Identities that are assigned to the Container App. If a Managed Identity is not specified here, default settings will be used."
-                      },
-                      "nullable": true
-                    },
-                    "maxInactiveRevisions": {
-                      "type": "int",
-                      "defaultValue": 0,
-                      "metadata": {
-                        "description": "Optional. Max inactive revisions a Container App can have."
-                      }
-                    },
-                    "runtime": {
-                      "type": "object",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/configuration/properties/runtime"
-                        },
-                        "description": "Optional. Runtime configuration for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "containers": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/containers"
-                        },
-                        "description": "Required. List of container definitions for the Container App."
-                      }
-                    },
-                    "terminationGracePeriodSeconds": {
-                      "type": "int",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The termination grace period for the container app."
-                      }
-                    },
-                    "initContainersTemplate": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/initContainers"
-                        },
-                        "description": "Optional. List of specialized containers that run before app containers."
-                      },
-                      "nullable": true
-                    },
-                    "secrets": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/secretType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The secrets of the Container App."
-                      }
-                    },
-                    "revisionSuffix": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. User friendly suffix that is appended to the revision name."
-                      }
-                    },
-                    "volumes": {
-                      "type": "array",
-                      "metadata": {
-                        "__bicep_resource_derived_type!": {
-                          "source": "Microsoft.App/containerApps@2025-02-02-preview#properties/properties/properties/template/properties/volumes"
-                        },
-                        "description": "Optional. List of volume definitions for the Container App."
-                      },
-                      "nullable": true
-                    },
-                    "workloadProfileName": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. Workload profile name to pin for container app execution."
-                      }
-                    },
-                    "authConfig": {
-                      "$ref": "#/definitions/authConfigType",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The name of the Container App Auth configs."
-                      }
-                    },
-                    "diagnosticSettings": {
-                      "type": "array",
-                      "items": {
-                        "$ref": "#/definitions/diagnosticSettingMetricsOnlyType"
-                      },
-                      "nullable": true,
-                      "metadata": {
-                        "description": "Optional. The diagnostic settings of the service."
-                      }
-                    }
-                  },
-                  "variables": {
-                    "copy": [
-                      {
-                        "name": "formattedRoleAssignments",
-                        "count": "[length(coalesce(parameters('roleAssignments'), createArray()))]",
-                        "input": "[union(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')], createObject('roleDefinitionId', coalesce(tryGet(variables('builtInRoleNames'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName), if(contains(coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, '/providers/Microsoft.Authorization/roleDefinitions/'), coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName, subscriptionResourceId('Microsoft.Authorization/roleDefinitions', coalesce(parameters('roleAssignments'), createArray())[copyIndex('formattedRoleAssignments')].roleDefinitionIdOrName)))))]"
-                      }
-                    ],
-                    "formattedUserAssignedIdentities": "[reduce(map(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createArray()), lambda('id', createObject(format('{0}', lambdaVariables('id')), createObject()))), createObject(), lambda('cur', 'next', union(lambdaVariables('cur'), lambdaVariables('next'))))]",
-                    "identity": "[if(not(empty(parameters('managedIdentities'))), createObject('type', if(coalesce(tryGet(parameters('managedIdentities'), 'systemAssigned'), false()), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'SystemAssigned,UserAssigned', 'SystemAssigned'), if(not(empty(coalesce(tryGet(parameters('managedIdentities'), 'userAssignedResourceIds'), createObject()))), 'UserAssigned', 'None')), 'userAssignedIdentities', if(not(empty(variables('formattedUserAssignedIdentities'))), variables('formattedUserAssignedIdentities'), null())), null())]",
-                    "builtInRoleNames": {
-                      "ContainerApp Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ad2dd5fb-cd4b-4fd4-a9b6-4fed3630980b')]",
-                      "Contributor": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
-                      "Owner": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '8e3af657-a8ff-443c-a75c-2fe8c4bcb635')]",
-                      "Reader": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'acdd72a7-3385-48ef-bd42-f606fba81ae7')]",
-                      "Role Based Access Control Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'f58310d9-a9f6-439a-9e8d-f62e7b41a168')]",
-                      "User Access Administrator": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '18d7d88d-d35e-4fb5-a5c3-7773c20a72d9')]"
-                    }
-                  },
-                  "resources": {
-                    "avmTelemetry": {
-                      "condition": "[parameters('enableTelemetry')]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2024-03-01",
-                      "name": "[format('46d3xbcp.res.app-containerapp.{0}.{1}', replace('0.19.0', '.', '-'), substring(uniqueString(deployment().name, parameters('location')), 0, 4))]",
-                      "properties": {
-                        "mode": "Incremental",
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "contentVersion": "1.0.0.0",
-                          "resources": [],
-                          "outputs": {
-                            "telemetry": {
-                              "type": "String",
-                              "value": "For more information, see https://aka.ms/avm/TelemetryInfo"
-                            }
-                          }
-                        }
-                      }
-                    },
-                    "containerApp": {
-                      "type": "Microsoft.App/containerApps",
-                      "apiVersion": "2025-02-02-preview",
-                      "name": "[parameters('name')]",
-                      "tags": "[parameters('tags')]",
-                      "kind": "[parameters('kind')]",
-                      "location": "[parameters('location')]",
-                      "identity": "[variables('identity')]",
-                      "properties": {
-                        "environmentId": "[parameters('environmentResourceId')]",
-                        "workloadProfileName": "[parameters('workloadProfileName')]",
-                        "template": {
-                          "containers": "[parameters('containers')]",
-                          "terminationGracePeriodSeconds": "[parameters('terminationGracePeriodSeconds')]",
-                          "initContainers": "[if(not(empty(parameters('initContainersTemplate'))), parameters('initContainersTemplate'), null())]",
-                          "revisionSuffix": "[parameters('revisionSuffix')]",
-                          "scale": "[parameters('scaleSettings')]",
-                          "serviceBinds": "[if(and(parameters('includeAddOns'), not(empty(parameters('serviceBinds')))), parameters('serviceBinds'), null())]",
-                          "volumes": "[if(not(empty(parameters('volumes'))), parameters('volumes'), null())]"
-                        },
-                        "configuration": {
-                          "activeRevisionsMode": "[parameters('activeRevisionsMode')]",
-                          "dapr": "[if(not(empty(parameters('dapr'))), parameters('dapr'), null())]",
-                          "identitySettings": "[if(not(empty(parameters('identitySettings'))), parameters('identitySettings'), null())]",
-                          "ingress": "[if(parameters('disableIngress'), null(), createObject('additionalPortMappings', parameters('additionalPortMappings'), 'allowInsecure', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('ingressAllowInsecure'), false()), 'customDomains', if(not(empty(parameters('customDomains'))), parameters('customDomains'), null()), 'corsPolicy', if(and(not(equals(parameters('corsPolicy'), null())), not(equals(parameters('ingressTransport'), 'tcp'))), createObject('allowCredentials', coalesce(tryGet(parameters('corsPolicy'), 'allowCredentials'), false()), 'allowedHeaders', coalesce(tryGet(parameters('corsPolicy'), 'allowedHeaders'), createArray()), 'allowedMethods', coalesce(tryGet(parameters('corsPolicy'), 'allowedMethods'), createArray()), 'allowedOrigins', coalesce(tryGet(parameters('corsPolicy'), 'allowedOrigins'), createArray()), 'exposeHeaders', coalesce(tryGet(parameters('corsPolicy'), 'exposeHeaders'), createArray()), 'maxAge', tryGet(parameters('corsPolicy'), 'maxAge')), null()), 'clientCertificateMode', if(not(equals(parameters('ingressTransport'), 'tcp')), parameters('clientCertificateMode'), null()), 'exposedPort', parameters('exposedPort'), 'external', parameters('ingressExternal'), 'ipSecurityRestrictions', if(not(empty(parameters('ipSecurityRestrictions'))), parameters('ipSecurityRestrictions'), null()), 'targetPort', parameters('ingressTargetPort'), 'stickySessions', createObject('affinity', parameters('stickySessionsAffinity')), 'traffic', if(not(equals(parameters('ingressTransport'), 'tcp')), createArray(createObject('label', parameters('trafficLabel'), 'latestRevision', parameters('trafficLatestRevision'), 'revisionName', parameters('trafficRevisionName'), 'weight', parameters('trafficWeight'))), null()), 'transport', parameters('ingressTransport')))]",
-                          "service": "[if(and(parameters('includeAddOns'), not(empty(parameters('service')))), parameters('service'), null())]",
-                          "maxInactiveRevisions": "[parameters('maxInactiveRevisions')]",
-                          "registries": "[if(not(empty(parameters('registries'))), parameters('registries'), null())]",
-                          "secrets": "[parameters('secrets')]",
-                          "runtime": "[if(not(empty(parameters('runtime'))), parameters('runtime'), null())]"
-                        }
-                      }
-                    },
-                    "containerApp_lock": {
-                      "condition": "[and(not(empty(coalesce(parameters('lock'), createObject()))), not(equals(tryGet(parameters('lock'), 'kind'), 'None')))]",
-                      "type": "Microsoft.Authorization/locks",
-                      "apiVersion": "2020-05-01",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(parameters('lock'), 'name'), format('lock-{0}', parameters('name')))]",
-                      "properties": {
-                        "level": "[coalesce(tryGet(parameters('lock'), 'kind'), '')]",
-                        "notes": "[coalesce(tryGet(parameters('lock'), 'notes'), if(equals(tryGet(parameters('lock'), 'kind'), 'CanNotDelete'), 'Cannot delete resource or child resources.', 'Cannot delete or modify the resource or child resources.'))]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerApp_roleAssignments": {
-                      "copy": {
-                        "name": "containerApp_roleAssignments",
-                        "count": "[length(coalesce(variables('formattedRoleAssignments'), createArray()))]"
-                      },
-                      "type": "Microsoft.Authorization/roleAssignments",
-                      "apiVersion": "2022-04-01",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'name'), guid(resourceId('Microsoft.App/containerApps', parameters('name')), coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId, coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId))]",
-                      "properties": {
-                        "roleDefinitionId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].roleDefinitionId]",
-                        "principalId": "[coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()].principalId]",
-                        "description": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'description')]",
-                        "principalType": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'principalType')]",
-                        "condition": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition')]",
-                        "conditionVersion": "[if(not(empty(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'condition'))), coalesce(tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'conditionVersion'), '2.0'), null())]",
-                        "delegatedManagedIdentityResourceId": "[tryGet(coalesce(variables('formattedRoleAssignments'), createArray())[copyIndex()], 'delegatedManagedIdentityResourceId')]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerApp_diagnosticSettings": {
-                      "copy": {
-                        "name": "containerApp_diagnosticSettings",
-                        "count": "[length(coalesce(parameters('diagnosticSettings'), createArray()))]"
-                      },
-                      "type": "Microsoft.Insights/diagnosticSettings",
-                      "apiVersion": "2021-05-01-preview",
-                      "scope": "[format('Microsoft.App/containerApps/{0}', parameters('name'))]",
-                      "name": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'name'), format('{0}-diagnosticSettings', parameters('name')))]",
-                      "properties": {
-                        "copy": [
-                          {
-                            "name": "metrics",
-                            "count": "[length(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics'))))]",
-                            "input": {
-                              "category": "[coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')].category]",
-                              "enabled": "[coalesce(tryGet(coalesce(tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'metricCategories'), createArray(createObject('category', 'AllMetrics')))[copyIndex('metrics')], 'enabled'), true())]",
-                              "timeGrain": null
-                            }
-                          }
-                        ],
-                        "storageAccountId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'storageAccountResourceId')]",
-                        "workspaceId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'workspaceResourceId')]",
-                        "eventHubAuthorizationRuleId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubAuthorizationRuleResourceId')]",
-                        "eventHubName": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'eventHubName')]",
-                        "marketplacePartnerId": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'marketplacePartnerResourceId')]",
-                        "logAnalyticsDestinationType": "[tryGet(coalesce(parameters('diagnosticSettings'), createArray())[copyIndex()], 'logAnalyticsDestinationType')]"
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    },
-                    "containerAppAuthConfigs": {
-                      "condition": "[not(empty(parameters('authConfig')))]",
-                      "type": "Microsoft.Resources/deployments",
-                      "apiVersion": "2025-04-01",
-                      "name": "[format('{0}-auth-config', uniqueString(deployment().name, parameters('location')))]",
-                      "properties": {
-                        "expressionEvaluationOptions": {
-                          "scope": "inner"
-                        },
-                        "mode": "Incremental",
-                        "parameters": {
-                          "containerAppName": {
-                            "value": "[parameters('name')]"
-                          },
-                          "encryptionSettings": {
-                            "value": "[tryGet(parameters('authConfig'), 'encryptionSettings')]"
-                          },
-                          "globalValidation": {
-                            "value": "[tryGet(parameters('authConfig'), 'globalValidation')]"
-                          },
-                          "httpSettings": {
-                            "value": "[tryGet(parameters('authConfig'), 'httpSettings')]"
-                          },
-                          "identityProviders": {
-                            "value": "[tryGet(parameters('authConfig'), 'identityProviders')]"
-                          },
-                          "login": {
-                            "value": "[tryGet(parameters('authConfig'), 'login')]"
-                          },
-                          "platform": {
-                            "value": "[tryGet(parameters('authConfig'), 'platform')]"
-                          }
-                        },
-                        "template": {
-                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
-                          "languageVersion": "2.0",
-                          "contentVersion": "1.0.0.0",
-                          "metadata": {
-                            "_generator": {
-                              "name": "bicep",
-                              "version": "0.38.33.27573",
-                              "templateHash": "12480411243596309951"
-                            },
-                            "name": "Container App Auth Configs",
-                            "description": "This module deploys Container App Auth Configs."
-                          },
-                          "parameters": {
-                            "containerAppName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "Conditional. The name of the parent Container App. Required if the template is used in a standalone deployment."
-                              }
-                            },
-                            "encryptionSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/encryptionSettings"
-                                },
-                                "description": "Optional. The configuration settings of the secrets references of encryption key and signing key for ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "globalValidation": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/globalValidation"
-                                },
-                                "description": "Optional. The configuration settings that determines the validation flow of users using Service Authentication and/or Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "httpSettings": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/httpSettings"
-                                },
-                                "description": "Optional. The configuration settings of the HTTP requests for authentication and authorization requests made against ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "identityProviders": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/identityProviders"
-                                },
-                                "description": "Optional. The configuration settings of each of the identity providers used to configure ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "login": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/login"
-                                },
-                                "description": "Optional. The configuration settings of the login flow of users using ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            },
-                            "platform": {
-                              "type": "object",
-                              "metadata": {
-                                "__bicep_resource_derived_type!": {
-                                  "source": "Microsoft.App/containerApps/authConfigs@2025-02-02-preview#properties/properties/properties/platform"
-                                },
-                                "description": "Optional. The configuration settings of the platform of ContainerApp Service Authentication/Authorization."
-                              },
-                              "nullable": true
-                            }
-                          },
-                          "resources": {
-                            "containerApp": {
-                              "existing": true,
-                              "type": "Microsoft.App/containerApps",
-                              "apiVersion": "2025-02-02-preview",
-                              "name": "[parameters('containerAppName')]"
-                            },
-                            "containerAppAuthConfigs": {
-                              "type": "Microsoft.App/containerApps/authConfigs",
-                              "apiVersion": "2025-02-02-preview",
-                              "name": "[format('{0}/{1}', parameters('containerAppName'), 'current')]",
-                              "properties": {
-                                "encryptionSettings": "[parameters('encryptionSettings')]",
-                                "globalValidation": "[parameters('globalValidation')]",
-                                "httpSettings": "[parameters('httpSettings')]",
-                                "identityProviders": "[parameters('identityProviders')]",
-                                "login": "[parameters('login')]",
-                                "platform": "[parameters('platform')]"
-                              }
-                            }
-                          },
-                          "outputs": {
-                            "name": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The name of the set of Container App Auth configs."
-                              },
-                              "value": "current"
-                            },
-                            "resourceId": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource ID of the set of Container App Auth configs."
-                              },
-                              "value": "[resourceId('Microsoft.App/containerApps/authConfigs', parameters('containerAppName'), 'current')]"
-                            },
-                            "resourceGroupName": {
-                              "type": "string",
-                              "metadata": {
-                                "description": "The resource group containing the set of Container App Auth configs."
-                              },
-                              "value": "[resourceGroup().name]"
-                            }
-                          }
-                        }
-                      },
-                      "dependsOn": [
-                        "containerApp"
-                      ]
-                    }
-                  },
-                  "outputs": {
-                    "resourceId": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The resource ID of the Container App."
-                      },
-                      "value": "[resourceId('Microsoft.App/containerApps', parameters('name'))]"
-                    },
-                    "fqdn": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The configuration of ingress fqdn."
-                      },
-                      "value": "[if(parameters('disableIngress'), 'IngressDisabled', reference('containerApp').configuration.ingress.fqdn)]"
-                    },
-                    "resourceGroupName": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the resource group the Container App was deployed into."
-                      },
-                      "value": "[resourceGroup().name]"
-                    },
-                    "name": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The name of the Container App."
-                      },
-                      "value": "[parameters('name')]"
-                    },
-                    "systemAssignedMIPrincipalId": {
-                      "type": "string",
-                      "nullable": true,
-                      "metadata": {
-                        "description": "The principal ID of the system assigned identity."
-                      },
-                      "value": "[tryGet(tryGet(reference('containerApp', '2025-02-02-preview', 'full'), 'identity'), 'principalId')]"
-                    },
-                    "location": {
-                      "type": "string",
-                      "metadata": {
-                        "description": "The location the resource was deployed into."
-                      },
-                      "value": "[reference('containerApp', '2025-02-02-preview', 'full').location]"
-                    }
-                  }
-                }
-              }
-            }
-          ],
-          "outputs": {
-            "resourceId": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.resourceId.value]"
-            },
-            "name": {
-              "type": "string",
-              "value": "[format('{0}.containerApp', deployment().name)]"
-            },
-            "fqdn": {
-              "type": "string",
-              "value": "[reference(resourceId('Microsoft.Resources/deployments', format('{0}.containerApp', deployment().name)), '2025-04-01').outputs.fqdn.value]"
-            }
-          }
-        }
-      },
-      "dependsOn": [
-        "apiContainerApp",
-        "containerAppsEnvironment",
-        "containerRegistry",
-        "userAssignedIdentity"
-      ]
-    }
-  },
-  "outputs": {
-    "DEPLOYMENT_MODE": {
-      "type": "string",
-      "value": "[parameters('deploymentMode')]"
-    },
-    "AZURE_LOCATION": {
-      "type": "string",
-      "value": "[parameters('location')]"
-    },
-    "AZURE_TENANT_ID": {
-      "type": "string",
-      "value": "[tenant().tenantId]"
-    },
-    "AZURE_RESOURCE_GROUP": {
-      "type": "string",
-      "value": "[resourceGroup().name]"
-    },
-    "AZURE_CONTAINER_REGISTRY_ENDPOINT": {
-      "type": "string",
-      "value": "[reference('containerRegistry').outputs.loginServer.value]"
-    },
-    "AZURE_CONTAINER_REGISTRY_NAME": {
-      "type": "string",
-      "value": "[reference('containerRegistry').outputs.name.value]"
-    },
-    "API_ENDPOINT": {
-      "type": "string",
-      "value": "[format('https://{0}', reference('apiContainerApp').outputs.fqdn.value)]"
-    },
-    "WORKER_ENDPOINT": {
-      "type": "string",
-      "value": "[format('https://{0}', reference('workerContainerApp').outputs.fqdn.value)]"
-    },
-    "WEB_ENDPOINT": {
-      "type": "string",
-      "value": "[format('https://{0}', reference('webContainerApp').outputs.fqdn.value)]"
-    },
-    "COSMOS_DB_ENDPOINT": {
-      "type": "string",
-      "value": "[reference('cosmos').outputs.cosmosEndpoint.value]"
-    },
-    "COSMOS_DB_NAME": {
-      "type": "string",
-      "value": "[parameters('cosmosDbName')]"
-    },
-    "STORAGE_ACCOUNT_NAME": {
-      "type": "string",
-      "value": "[reference('storage').outputs.name.value]"
-    },
-    "STORAGE_QUEUE_URL": {
-      "type": "string",
-      "value": "[reference('storage').outputs.primaryQueueEndpoint.value]"
-    },
-    "STORAGE_QUEUE_NAME": {
-      "type": "string",
-      "value": "[parameters('workerQueueName')]"
-    },
-    "APP_CONFIG_ENDPOINT": {
-      "type": "string",
-      "value": "[reference('appConfigStore').outputs.endpoint.value]"
-    },
-    "APPLICATIONINSIGHTS_CONNECTION_STRING": {
-      "type": "string",
-      "value": "[if(not(empty(parameters('existingAppInsightsId'))), reference(parameters('existingAppInsightsId'), '2020-02-02').ConnectionString, if(variables('shouldCreateAppInsights'), reference('appInsights').outputs.connectionString.value, ''))]"
-    },
-    "MANAGED_IDENTITY_CLIENT_ID": {
-      "type": "string",
-      "value": "[reference('userAssignedIdentity').outputs.clientId.value]"
-    },
-    "MANAGED_IDENTITY_PRINCIPAL_ID": {
-      "type": "string",
-      "value": "[reference('userAssignedIdentity').outputs.principalId.value]"
-    },
-    "AZURE_AI_FOUNDRY_LOCATION": {
-      "type": "string",
-      "value": "[reference('aiFoundry').outputs.location.value]"
-    },
-    "AI_PROJECT_NAME": {
-      "type": "string",
-      "value": "[reference('aiFoundry').outputs.aiProjectName.value]"
-    },
-    "AI_SERVICES_NAME": {
-      "type": "string",
-      "value": "[reference('aiFoundry').outputs.aiServicesName.value]"
-    },
-    "VNET_RESOURCE_ID": {
-      "type": "string",
-      "value": "[if(variables('isAILZIntegrated'), parameters('existingVnetResourceId'), '')]"
-    },
-    "PRIVATE_ENDPOINT_SUBNET_ID": {
-      "type": "string",
-      "value": "[if(variables('isAILZIntegrated'), variables('networkConfig').privateEndpointSubnetId, '')]"
-    },
-    "CONTAINER_APPS_SUBNET_ID": {
-      "type": "string",
-      "value": "[if(variables('isAILZIntegrated'), variables('networkConfig').containerAppsSubnetId, '')]"
-    }
-  }
-}
\ No newline at end of file
diff --git a/infra/bicep/modules/ai-foundry.bicep b/infra/bicep/modules/ai-foundry.bicep
index ef7c815..049e1c8 100644
--- a/infra/bicep/modules/ai-foundry.bicep
+++ b/infra/bicep/modules/ai-foundry.bicep
@@ -75,7 +75,7 @@ module aiFoundry 'br/public:avm/ptn/ai-ml/ai-foundry:0.5.0' = {
         }
         name: 'text-embedding-3-large'
         sku: {
-          capacity: 40
+          capacity: 100
           name: 'Standard'
         }
       }
diff --git a/infra/scripts/ailz-resources.env b/infra/scripts/ailz-resources.env
index 9f7f7ac..38a76f5 100644
--- a/infra/scripts/ailz-resources.env
+++ b/infra/scripts/ailz-resources.env
@@ -1,18 +1,18 @@
 # AILZ Resource IDs for ContentFlow Deployment
-# Generated on Fri, Apr 17, 2026 12:38:48 AM
-# AILZ Resource Group: RG-AI-CFSE
+# Generated on Wed, May 27, 2026  2:05:04 PM
+# AILZ Resource Group: rg-ai-amer-v-rramini-ailz-contentflow-poc1
 
-EXISTING_VNET_RESOURCE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/Microsoft.Network/virtualNetworks/vnet-wffp43ljodbow"
+EXISTING_VNET_RESOURCE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/virtualNetworks/vnet-7rtqmkghg6mq6"
 PRIVATE_ENDPOINT_SUBNET_NAME="pe-subnet"
 CONTAINER_APPS_SUBNET_NAME="aca-environment-subnet"
-EXISTING_COGNITIVE_SERVICES_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com"
-EXISTING_BLOB_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net"
-EXISTING_COSMOS_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.documents.azure.com"
-EXISTING_APP_CONFIG_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.azconfig.io"
-EXISTING_ACR_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
+EXISTING_COGNITIVE_SERVICES_PRIVATE_DNS_ZONE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/privateDnsZones/privatelink.cognitiveservices.azure.com"
+EXISTING_BLOB_PRIVATE_DNS_ZONE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/privateDnsZones/privatelink.blob.core.windows.net"
+EXISTING_COSMOS_PRIVATE_DNS_ZONE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/privateDnsZones/privatelink.documents.azure.com"
+EXISTING_APP_CONFIG_PRIVATE_DNS_ZONE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/privateDnsZones/privatelink.azconfig.io"
+EXISTING_ACR_PRIVATE_DNS_ZONE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/privateDnsZones/privatelink.azurecr.io"
 # EXISTING_CONTAINER_APPS_ENV_PRIVATE_DNS_ZONE_ID not found
-JUMPBOX_VM_RESOURCE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/Microsoft.Compute/virtualMachines/testvmwffp43ljo"
-JUMPBOX_VM_NAME="testvmwffp43ljo"
-EXISTING_KEY_VAULT_PRIVATE_DNS_ZONE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/rg-ai-cfse/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net"
-EXISTING_LOG_ANALYTICS_WORKSPACE_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/Microsoft.OperationalInsights/workspaces/log-wffp43ljodbow"
-EXISTING_APP_INSIGHTS_ID="/subscriptions/3897993c-c36d-4f3b-a581-f4dd4f8bd6fa/resourceGroups/RG-AI-CFSE/providers/microsoft.insights/components/appi-wffp43ljodbow"
+# JUMPBOX_VM_RESOURCE_ID not found - no JumpBox VM deployed
+# JUMPBOX_VM_NAME not found - no JumpBox VM deployed
+EXISTING_KEY_VAULT_PRIVATE_DNS_ZONE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.Network/privateDnsZones/privatelink.vaultcore.azure.net"
+EXISTING_LOG_ANALYTICS_WORKSPACE_ID="/subscriptions/9ad6f7f4-b0d6-4d88-a6d1-3fc2257d5583/resourceGroups/rg-ai-amer-v-rramini-ailz-contentflow-poc1/providers/Microsoft.OperationalInsights/workspaces/log-7rtqmkghg6mq6"
+# EXISTING_APP_INSIGHTS_ID not found
diff --git a/infra/scripts/post-deploy-worker.sh b/infra/scripts/post-deploy-worker.sh
deleted file mode 100755
index a1408d3..0000000
--- a/infra/scripts/post-deploy-worker.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/bash
-# Post-deploy hook for Worker service
-set -e
-
-echo "=================================================="
-echo "ContentFlow Worker - Post-Deploy Hook"
-echo "=================================================="
-
-echo "✓ Worker service deployed successfully"
-
-# Optional: Run any Worker-specific post-deployment tasks here
-
-echo "=================================================="
diff --git a/infra/scripts/post-deploy.sh b/infra/scripts/post-deploy.sh
index acda17f..76701d1 100755
--- a/infra/scripts/post-deploy.sh
+++ b/infra/scripts/post-deploy.sh
@@ -10,7 +10,6 @@ echo "=================================================="
 # Get deployment outputs
 API_ENDPOINT=$(azd env get-value API_ENDPOINT 2>/dev/null || echo "Not available")
 WEB_ENDPOINT=$(azd env get-value WEB_ENDPOINT 2>/dev/null || echo "Not available")
-# WORKER DISABLED: WORKER_ENDPOINT=$(azd env get-value WORKER_ENDPOINT 2>/dev/null || echo "Not available")
 
 echo ""
 echo "╔════════════════════════════════════════════════╗"
@@ -20,7 +19,6 @@ echo ""
 echo "Service Endpoints:"
 echo "  API:    $API_ENDPOINT"
 echo "  Web:    $WEB_ENDPOINT"
-# WORKER DISABLED: echo "  Worker: $WORKER_ENDPOINT"
 echo ""
 
 # ========== SECURITY HARDENING (AILZ mode only) ==========
diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index b045eda..b867a43 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -17,16 +17,6 @@ echo "Resource Group: $RESOURCE_GROUP"
 echo "Storage Account: $STORAGE_ACCOUNT"
 echo "Cosmos DB Endpoint: $COSMOS_ENDPOINT"
 
-# --- WORKER DISABLED: uncomment to re-enable queue creation ---
-# echo "✓ Creating storage queue (if not exists)..."
-# QUEUE_NAME="contentflow-execution-requests"
-# az storage queue create \
-#   --name "$QUEUE_NAME" \
-#   --account-name "$STORAGE_ACCOUNT" \
-#   --auth-mode login \
-#   --only-show-errors || echo "Queue already exists or error creating queue"
-# --- END WORKER DISABLED ---
-
 # ========== DEPLOYER ROLE ASSIGNMENT ==========
 echo ""
 echo "=================================================="

From ae5c60a176adb3521455e40fba0b7dba9d844ba9 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Thu, 28 May 2026 21:01:28 +0000
Subject: [PATCH 25/28] fix: use PATCH write-probe instead of read-only RBAC
 probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The RBAC readiness probe previously tested GET /analyzers (read operation).
On a brand-new AI Services resource, data-plane WRITE RBAC propagation
takes 15-30 minutes — significantly longer than reads (~6 min).
The read probe gave a false-positive, causing PATCH defaults to fail
with HTTP 401 while write propagation was still in progress.

Fix: replace the separate read-probe + PATCH-retry pattern with a
single write-probe that uses the actual PATCH defaults call as the
readiness test. Retries every 30s for up to 30 minutes (60 attempts),
ensuring the script waits for write-level RBAC propagation.

This resolves the consistent first-azd-up failure on fresh deployments.
---
 infra/scripts/post-provision.sh | 130 +++++++++++++-------------------
 1 file changed, 53 insertions(+), 77 deletions(-)

diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index b867a43..b70fccc 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -85,96 +85,72 @@ else
             --query accessToken -o tsv 2>/dev/null || echo ""
     }
 
-    # --- RBAC Readiness Probe ---
-    # Instead of a fixed sleep, poll the CU data-plane until RBAC propagates.
-    # Retries every 30s for up to 30 minutes (60 attempts).
-    echo "Probing CU data-plane for RBAC readiness (up to 30 minutes)..."
-    RBAC_MAX_ATTEMPTS=60
-    RBAC_WAIT_SECONDS=30
-    RBAC_READY=false
+    # --- Combined RBAC + CU Defaults Probe ---
+    # The RBAC probe must test a WRITE operation, not just a read.
+    # On a brand-new AI Services resource, data-plane WRITE permission
+    # propagation takes 15-30 minutes — significantly longer than reads
+    # (~6 min). A read-only probe gives a false-positive, causing writes
+    # to fail with HTTP 401 while propagation is still in progress.
+    #
+    # Solution: use the actual PATCH defaults call as the probe.
+    # This retries every 30s for up to 30 minutes (60 attempts),
+    # ensuring we wait for write-level RBAC propagation.
+    echo ""
+    echo "[CU-1] Setting default model deployments (with RBAC write-readiness probe, up to 30 min)..."
+    DEFAULTS_MAX_ATTEMPTS=60
+    DEFAULTS_WAIT_SECONDS=30
+    DEFAULTS_OK=false
     ACCESS_TOKEN=""
 
-    for RBAC_ATTEMPT in $(seq 1 $RBAC_MAX_ATTEMPTS); do
+    for DEFAULTS_ATTEMPT in $(seq 1 $DEFAULTS_MAX_ATTEMPTS); do
         ACCESS_TOKEN=$(acquire_token)
         if [ -z "$ACCESS_TOKEN" ]; then
-            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] Failed to acquire token — retrying in ${RBAC_WAIT_SECONDS}s..."
-            sleep "$RBAC_WAIT_SECONDS"
+            echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_ATTEMPTS] Failed to acquire token — retrying in ${DEFAULTS_WAIT_SECONDS}s..."
+            sleep "$DEFAULTS_WAIT_SECONDS"
             continue
         fi
 
-        PROBE_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-            "${CU_ENDPOINT}/contentunderstanding/analyzers?api-version=${CU_API_VERSION}" \
-            -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null)
-
-        if [ "$PROBE_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$PROBE_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-            echo "  ✅ RBAC is active (HTTP $PROBE_HTTP_CODE on attempt $RBAC_ATTEMPT)"
-            RBAC_READY=true
+        CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
+            "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
+            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+            -H "Content-Type: application/merge-patch+json" \
+            -d '{
+                "modelDeployments": {
+                    "gpt-4.1": "gpt-4.1",
+                    "gpt-4.1-mini": "gpt-4.1-mini",
+                    "text-embedding-3-large": "text-embedding-3-large"
+                }
+            }' 2>/dev/null)
+
+        CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
+        CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
+
+        if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+            echo "  ✅ Default model deployments configured (HTTP $CU_DEFAULTS_HTTP_CODE, attempt $DEFAULTS_ATTEMPT)"
+            DEFAULTS_OK=true
             break
-        else
-            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] RBAC not ready (HTTP $PROBE_HTTP_CODE) — retrying in ${RBAC_WAIT_SECONDS}s..."
-            sleep "$RBAC_WAIT_SECONDS"
         fi
+
+        # Retry on auth/propagation and transient errors
+        case "$CU_DEFAULTS_HTTP_CODE" in
+            401|403|429|500|502|503|504)
+                echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_ATTEMPTS] CU defaults PATCH failed (HTTP $CU_DEFAULTS_HTTP_CODE) — retrying in ${DEFAULTS_WAIT_SECONDS}s..."
+                sleep "$DEFAULTS_WAIT_SECONDS"
+                ;;
+            *)
+                echo "  ❌ CU defaults failed with non-retryable error (HTTP $CU_DEFAULTS_HTTP_CODE)"
+                echo "     Response: $CU_DEFAULTS_BODY"
+                break
+                ;;
+        esac
     done
 
-    if [ "$RBAC_READY" != "true" ]; then
-        echo "❌ RBAC did not propagate within $((RBAC_MAX_ATTEMPTS * RBAC_WAIT_SECONDS)) seconds."
-        echo "   Re-run 'azd up' or 'azd hooks run postprovision' after a few minutes."
+    if [ "$DEFAULTS_OK" != "true" ]; then
+        echo "❌ Failed to set CU defaults after $DEFAULTS_MAX_ATTEMPTS attempts ($((DEFAULTS_MAX_ATTEMPTS * DEFAULTS_WAIT_SECONDS))s)."
+        echo "   RBAC write-level propagation may not have completed."
+        echo "   Re-run 'azd hooks run postprovision' after a few minutes."
         exit 1
     else
-        # --- Step 1: Set default model deployments (with retry) ---
-        echo ""
-        echo "[CU-1] Setting default model deployments..."
-        DEFAULTS_MAX_RETRIES=5
-        DEFAULTS_BACKOFF=15
-        DEFAULTS_OK=false
-
-        for DEFAULTS_ATTEMPT in $(seq 1 $DEFAULTS_MAX_RETRIES); do
-            # Refresh token before each attempt (handles expiry edge case)
-            if [ "$DEFAULTS_ATTEMPT" -gt 1 ]; then
-                ACCESS_TOKEN=$(acquire_token)
-            fi
-
-            CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
-                "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
-                -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-                -H "Content-Type: application/merge-patch+json" \
-                -d '{
-                    "modelDeployments": {
-                        "gpt-4.1": "gpt-4.1",
-                        "gpt-4.1-mini": "gpt-4.1-mini",
-                        "text-embedding-3-large": "text-embedding-3-large"
-                    }
-                }' 2>/dev/null)
-
-            CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
-            CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
-
-            if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-                echo "  ✅ Default model deployments configured successfully (attempt $DEFAULTS_ATTEMPT)"
-                DEFAULTS_OK=true
-                break
-            fi
-
-            # Retry on transient errors (401, 403, 429, 5xx)
-            case "$CU_DEFAULTS_HTTP_CODE" in
-                401|403|429|500|502|503|504)
-                    echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_RETRIES] CU defaults failed (HTTP $CU_DEFAULTS_HTTP_CODE) — retrying in ${DEFAULTS_BACKOFF}s..."
-                    sleep "$DEFAULTS_BACKOFF"
-                    DEFAULTS_BACKOFF=$((DEFAULTS_BACKOFF * 2))
-                    [ "$DEFAULTS_BACKOFF" -gt 120 ] && DEFAULTS_BACKOFF=120
-                    ;;
-                *)
-                    echo "  ⚠️  CU defaults failed with non-retryable error (HTTP $CU_DEFAULTS_HTTP_CODE)"
-                    echo "     Response: $CU_DEFAULTS_BODY"
-                    break
-                    ;;
-            esac
-        done
-
-        if [ "$DEFAULTS_OK" != "true" ]; then
-            echo "  ⚠️  Failed to set CU defaults after $DEFAULTS_MAX_RETRIES attempts."
-            echo "     Model deployments may not be available yet. Run post-provision again after models are ready."
-        fi
 
         # --- Step 2: Create/update custom analyzers from seed folder ---
         echo ""

From db3a8057b8d7c564ac1d193b93e64d73fc261ee7 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <RakeshRamini@MngEnvMCAP400868.onmicrosoft.com>
Date: Thu, 28 May 2026 21:01:28 +0000
Subject: [PATCH 26/28] fix: use PATCH write-probe instead of read-only RBAC
 probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The RBAC readiness probe previously tested GET /analyzers (read operation).
On a brand-new AI Services resource, data-plane WRITE RBAC propagation
takes 15-30 minutes — significantly longer than reads (~6 min).
The read probe gave a false-positive, causing PATCH defaults to fail
with HTTP 401 while write propagation was still in progress.

Fix: replace the separate read-probe + PATCH-retry pattern with a
single write-probe that uses the actual PATCH defaults call as the
readiness test. Retries every 30s for up to 30 minutes (60 attempts),
ensuring the script waits for write-level RBAC propagation.

This resolves the consistent first-azd-up failure on fresh deployments.
---
 infra/scripts/post-provision.sh | 130 +++++++++++++-------------------
 1 file changed, 53 insertions(+), 77 deletions(-)

diff --git a/infra/scripts/post-provision.sh b/infra/scripts/post-provision.sh
index 2beae6e..c9726dc 100755
--- a/infra/scripts/post-provision.sh
+++ b/infra/scripts/post-provision.sh
@@ -93,96 +93,72 @@ else
             --query accessToken -o tsv 2>/dev/null || echo ""
     }
 
-    # --- RBAC Readiness Probe ---
-    # Instead of a fixed sleep, poll the CU data-plane until RBAC propagates.
-    # Retries every 30s for up to 30 minutes (60 attempts).
-    echo "Probing CU data-plane for RBAC readiness (up to 30 minutes)..."
-    RBAC_MAX_ATTEMPTS=60
-    RBAC_WAIT_SECONDS=30
-    RBAC_READY=false
+    # --- Combined RBAC + CU Defaults Probe ---
+    # The RBAC probe must test a WRITE operation, not just a read.
+    # On a brand-new AI Services resource, data-plane WRITE permission
+    # propagation takes 15-30 minutes — significantly longer than reads
+    # (~6 min). A read-only probe gives a false-positive, causing writes
+    # to fail with HTTP 401 while propagation is still in progress.
+    #
+    # Solution: use the actual PATCH defaults call as the probe.
+    # This retries every 30s for up to 30 minutes (60 attempts),
+    # ensuring we wait for write-level RBAC propagation.
+    echo ""
+    echo "[CU-1] Setting default model deployments (with RBAC write-readiness probe, up to 30 min)..."
+    DEFAULTS_MAX_ATTEMPTS=60
+    DEFAULTS_WAIT_SECONDS=30
+    DEFAULTS_OK=false
     ACCESS_TOKEN=""
 
-    for RBAC_ATTEMPT in $(seq 1 $RBAC_MAX_ATTEMPTS); do
+    for DEFAULTS_ATTEMPT in $(seq 1 $DEFAULTS_MAX_ATTEMPTS); do
         ACCESS_TOKEN=$(acquire_token)
         if [ -z "$ACCESS_TOKEN" ]; then
-            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] Failed to acquire token — retrying in ${RBAC_WAIT_SECONDS}s..."
-            sleep "$RBAC_WAIT_SECONDS"
+            echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_ATTEMPTS] Failed to acquire token — retrying in ${DEFAULTS_WAIT_SECONDS}s..."
+            sleep "$DEFAULTS_WAIT_SECONDS"
             continue
         fi
 
-        PROBE_HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-            "${CU_ENDPOINT}/contentunderstanding/analyzers?api-version=${CU_API_VERSION}" \
-            -H "Authorization: Bearer ${ACCESS_TOKEN}" 2>/dev/null)
-
-        if [ "$PROBE_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$PROBE_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-            echo "  ✅ RBAC is active (HTTP $PROBE_HTTP_CODE on attempt $RBAC_ATTEMPT)"
-            RBAC_READY=true
+        CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
+            "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
+            -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+            -H "Content-Type: application/merge-patch+json" \
+            -d '{
+                "modelDeployments": {
+                    "gpt-4.1": "gpt-4.1",
+                    "gpt-4.1-mini": "gpt-4.1-mini",
+                    "text-embedding-3-large": "text-embedding-3-large"
+                }
+            }' 2>/dev/null)
+
+        CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
+        CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
+
+        if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
+            echo "  ✅ Default model deployments configured (HTTP $CU_DEFAULTS_HTTP_CODE, attempt $DEFAULTS_ATTEMPT)"
+            DEFAULTS_OK=true
             break
-        else
-            echo "  [attempt $RBAC_ATTEMPT/$RBAC_MAX_ATTEMPTS] RBAC not ready (HTTP $PROBE_HTTP_CODE) — retrying in ${RBAC_WAIT_SECONDS}s..."
-            sleep "$RBAC_WAIT_SECONDS"
         fi
+
+        # Retry on auth/propagation and transient errors
+        case "$CU_DEFAULTS_HTTP_CODE" in
+            401|403|429|500|502|503|504)
+                echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_ATTEMPTS] CU defaults PATCH failed (HTTP $CU_DEFAULTS_HTTP_CODE) — retrying in ${DEFAULTS_WAIT_SECONDS}s..."
+                sleep "$DEFAULTS_WAIT_SECONDS"
+                ;;
+            *)
+                echo "  ❌ CU defaults failed with non-retryable error (HTTP $CU_DEFAULTS_HTTP_CODE)"
+                echo "     Response: $CU_DEFAULTS_BODY"
+                break
+                ;;
+        esac
     done
 
-    if [ "$RBAC_READY" != "true" ]; then
-        echo "❌ RBAC did not propagate within $((RBAC_MAX_ATTEMPTS * RBAC_WAIT_SECONDS)) seconds."
-        echo "   Re-run 'azd up' or 'azd hooks run postprovision' after a few minutes."
+    if [ "$DEFAULTS_OK" != "true" ]; then
+        echo "❌ Failed to set CU defaults after $DEFAULTS_MAX_ATTEMPTS attempts ($((DEFAULTS_MAX_ATTEMPTS * DEFAULTS_WAIT_SECONDS))s)."
+        echo "   RBAC write-level propagation may not have completed."
+        echo "   Re-run 'azd hooks run postprovision' after a few minutes."
         exit 1
     else
-        # --- Step 1: Set default model deployments (with retry) ---
-        echo ""
-        echo "[CU-1] Setting default model deployments..."
-        DEFAULTS_MAX_RETRIES=5
-        DEFAULTS_BACKOFF=15
-        DEFAULTS_OK=false
-
-        for DEFAULTS_ATTEMPT in $(seq 1 $DEFAULTS_MAX_RETRIES); do
-            # Refresh token before each attempt (handles expiry edge case)
-            if [ "$DEFAULTS_ATTEMPT" -gt 1 ]; then
-                ACCESS_TOKEN=$(acquire_token)
-            fi
-
-            CU_DEFAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" -X PATCH \
-                "${CU_ENDPOINT}/contentunderstanding/defaults?api-version=${CU_API_VERSION}" \
-                -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-                -H "Content-Type: application/merge-patch+json" \
-                -d '{
-                    "modelDeployments": {
-                        "gpt-4.1": "gpt-4.1",
-                        "gpt-4.1-mini": "gpt-4.1-mini",
-                        "text-embedding-3-large": "text-embedding-3-large"
-                    }
-                }' 2>/dev/null)
-
-            CU_DEFAULTS_HTTP_CODE=$(echo "$CU_DEFAULTS_RESPONSE" | tail -1)
-            CU_DEFAULTS_BODY=$(echo "$CU_DEFAULTS_RESPONSE" | sed '$d')
-
-            if [ "$CU_DEFAULTS_HTTP_CODE" -ge 200 ] 2>/dev/null && [ "$CU_DEFAULTS_HTTP_CODE" -lt 300 ] 2>/dev/null; then
-                echo "  ✅ Default model deployments configured successfully (attempt $DEFAULTS_ATTEMPT)"
-                DEFAULTS_OK=true
-                break
-            fi
-
-            # Retry on transient errors (401, 403, 429, 5xx)
-            case "$CU_DEFAULTS_HTTP_CODE" in
-                401|403|429|500|502|503|504)
-                    echo "  [attempt $DEFAULTS_ATTEMPT/$DEFAULTS_MAX_RETRIES] CU defaults failed (HTTP $CU_DEFAULTS_HTTP_CODE) — retrying in ${DEFAULTS_BACKOFF}s..."
-                    sleep "$DEFAULTS_BACKOFF"
-                    DEFAULTS_BACKOFF=$((DEFAULTS_BACKOFF * 2))
-                    [ "$DEFAULTS_BACKOFF" -gt 120 ] && DEFAULTS_BACKOFF=120
-                    ;;
-                *)
-                    echo "  ⚠️  CU defaults failed with non-retryable error (HTTP $CU_DEFAULTS_HTTP_CODE)"
-                    echo "     Response: $CU_DEFAULTS_BODY"
-                    break
-                    ;;
-            esac
-        done
-
-        if [ "$DEFAULTS_OK" != "true" ]; then
-            echo "  ⚠️  Failed to set CU defaults after $DEFAULTS_MAX_RETRIES attempts."
-            echo "     Model deployments may not be available yet. Run post-provision again after models are ready."
-        fi
 
         # --- Step 2: Create/update custom analyzers from seed folder ---
         echo ""

From e0b01e6f0eab9ae5881a698bc94012fd3c7b5d34 Mon Sep 17 00:00:00 2001
From: Rakesh Ramini <reachoutrakesh@gmail.com>
Date: Wed, 10 Jun 2026 12:53:13 +0000
Subject: [PATCH 27/28] feat: add array index notation support to
 try_extract_nested_field_from_content

Extends the method in BaseExecutor to support [N] bracket notation within
dot-separated field paths, enabling access to list elements in Content data.

Example: 'result.contents[0].markdown' now correctly navigates
content.data['result']['contents'][0]['markdown'].

- Fully backward compatible with all existing dot-separated paths
- Returns None safely for out-of-bounds, non-integer, or missing keys
- Enables executors (azure_openai_agent_executor, content_classifier, etc.)
  to target specific array elements, reducing token usage and avoiding
  429 rate limit errors when processing Azure Content Understanding results
---
 contentflow-lib/contentflow/executors/base.py | 42 +++++++++++++++----
 1 file changed, 35 insertions(+), 7 deletions(-)

diff --git a/contentflow-lib/contentflow/executors/base.py b/contentflow-lib/contentflow/executors/base.py
index f4ba077..d7bef5f 100644
--- a/contentflow-lib/contentflow/executors/base.py
+++ b/contentflow-lib/contentflow/executors/base.py
@@ -196,22 +196,50 @@ def try_extract_nested_field_from_content(
     ) -> Any:
         """
         Extract a nested field value from a Content item's data.
-        
+
+        Supports dot-separated paths and array indexing with bracket notation.
+        Examples:
+            "text" -> content.data["text"]
+            "result.contents[0].markdown" -> content.data["result"]["contents"][0]["markdown"]
+
         Args:
             content: Content item to extract from
-            field_path: Dot-separated path to the field
+            field_path: Dot-separated path to the field, with optional [N] array indexing
         Returns:
             Extracted field value or None if not found
         """
         fields = field_path.split('.')
         current_value = content.data
-        
+
         for field in fields:
-            if isinstance(current_value, dict) and field in current_value:
-                current_value = current_value[field]
+            # Check for array index notation e.g. "contents[0]"
+            if '[' in field and field.endswith(']'):
+                bracket_pos = field.index('[')
+                key = field[:bracket_pos]
+                index_str = field[bracket_pos + 1:-1]
+
+                # Access the dict key first
+                if key:
+                    if isinstance(current_value, dict) and key in current_value:
+                        current_value = current_value[key]
+                    else:
+                        return None
+
+                # Then access the list index
+                try:
+                    index = int(index_str)
+                    if isinstance(current_value, list) and 0 <= index < len(current_value):
+                        current_value = current_value[index]
+                    else:
+                        return None
+                except (ValueError, TypeError):
+                    return None
             else:
-                return None
-        
+                if isinstance(current_value, dict) and field in current_value:
+                    current_value = current_value[field]
+                else:
+                    return None
+
         return current_value
     
     

From 5d08bd2038055ea2dc7ef130406e73cd7b6a208a Mon Sep 17 00:00:00 2001
From: Rakesh <53445161+RakeshRamini@users.noreply.github.com>
Date: Thu, 11 Jun 2026 15:06:36 +0000
Subject: [PATCH 28/28] Added rules.json to the repo

---
 rules.json | 205 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 205 insertions(+)
 create mode 100644 rules.json

diff --git a/rules.json b/rules.json
new file mode 100644
index 0000000..75d9fdb
--- /dev/null
+++ b/rules.json
@@ -0,0 +1,205 @@
+{
+  "rules": [
+    {
+      "documentType": "Driving License",
+      "validations": [
+        {
+          "field": "ExpirationDate",
+          "validationType": "expiry_check",
+          "errorCode": "DL_EXPIRED",
+          "message_en": "Your driving license has expired. Please upload a valid driving license.",
+          "message_es": "Su licencia de conducir ha expirado. Por favor, cargue una licencia de conducir válida."
+        },
+        {
+          "field": "FirstName",
+          "validationType": "exact_match",
+          "errorCode": "DL_FIRST_NAME_MISMATCH",
+          "message_en": "The first name on the driving license does not match the first name registered in your case.",
+          "message_es": "El nombre en la licencia de conducir no coincide con el nombre registrado en su caso."
+        },
+        {
+          "field": "LastName",
+          "validationType": "exact_match",
+          "errorCode": "DL_LAST_NAME_MISMATCH",
+          "message_en": "The last name on the driving license does not match the fist last and second last name registered in your case.",
+          "message_es": "El apellido en la licencia de conducir no coincide con el primer y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "DL_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the driving license does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la licencia de conducir no coincide con la dirección postal registrada en su caso."
+        },
+        {
+          "field": "BirthDate",
+          "validationType": "date_match",
+          "errorCode": "DL_DOB_MISMATCH",
+          "message_en": "The day of birth on the driving license does not match the birth date registered in your case.",
+          "message_es": "La fecha de nacimiento en la licencia de conducir no coincide con la fecha de nacimiento registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Passport",
+      "validations": [
+        {
+          "field": "ExpirationDate",
+          "validationType": "expiry_check",
+          "errorCode": "PP_EXPIRED",
+          "message_en": "Your passport has expired. Please upload a passport.",
+          "message_es": "Su pasaporte ha expirado. Por favor, cargue un pasaporte válido."
+        },
+        {
+          "field": "LastName",
+          "validationType": "exact_match",
+          "errorCode": "PP_LAST_NAME_MISMATCH",
+          "message_en": "The last name on the passport does not match the fist last and second last name registered in your case.",
+          "message_es": "El apellido en el pasaporte no coincide con el primer y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "FirstName",
+          "validationType": "exact_match",
+          "errorCode": "PP_FIRST_NAME_MISMATCH",
+          "message_en": "The first name on the passport does not match the first name registered in your case.",
+          "message_es": "El nombre en el pasaporte no coincide con el nombre registrado en su caso."
+        },
+        {
+          "field": "BirthDate",
+          "validationType": "date_match",
+          "errorCode": "PP_DOB_MISMATCH",
+          "message_en": "The day of birth on the passport does not match the birth date registered in your case.",
+          "message_es": "La fecha de nacimiento en el pasaporte no coincide con la fecha de nacimiento registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Real ID",
+      "validations": [
+        {
+          "field": "ExpirationDate",
+          "validationType": "expiry_check",
+          "errorCode": "RD_EXPIRED",
+          "message_en": "Your real ID has expired. Please upload a valid real ID.",
+          "message_es": "Su Real ID ha expirado. Por favor, cargue una Real ID válida."
+        },
+        {
+          "field": "FirstName",
+          "validationType": "exact_match",
+          "errorCode": "RD_FIRST_NAME_MISMATCH",
+          "message_en": "The first name on the real ID does not match the first name registered in your case.",
+          "message_es": "El nombre en la Real ID no coincide con el nombre registrado en su caso."
+        },
+        {
+          "field": "LastName",
+          "validationType": "exact_match",
+          "errorCode": "RD_LAST_NAME_MISMATCH",
+          "message_en": "The last name on the real ID does not match the first last and second last name registered in your case.",
+          "message_es": "El apellido en la Real ID no coincide con el primer y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "RD_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the real ID does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la Real ID no coincide con la dirección postal registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Water utility bill",
+      "validations": [
+        {
+          "field": "FullName",
+          "validationType": "name_match",
+          "errorCode": "WB_FIRST_LAST_NAME_MISMATCH",
+          "message_en": "The first and last name on the water utility bill does not match the first name, fist last and second last name registered in your case.",
+          "message_es": "El nombre y apellido en la factura de agua no coinciden con el nombre, primer apellido y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "WB_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the water utility bill does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la factura de agua no coincide con la dirección postal registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Power utility bill",
+      "validations": [
+        {
+          "field": "FullName",
+          "validationType": "name_match",
+          "errorCode": "PB_FIRST_LAST_NAME_MISMATCH",
+          "message_en": "The first and last name on the power utility bill does not match the first name, fist last and second last name registered in your case.",
+          "message_es": "El nombre y apellido en la factura de electricidad no coinciden con el nombre, primer apellido y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "PB_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the power utility bill does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la factura de electricidad no coincide con la dirección postal registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Telecom utility bill_claro",
+      "validations": [
+        {
+          "field": "FullName",
+          "validationType": "name_match",
+          "errorCode": "TC_FIRST_LAST_NAME_MISMATCH",
+          "message_en": "The first and last name on the telecom utility bill does not match the first name, fist last and second last name registered in your case.",
+          "message_es": "El nombre y apellido en la factura de telecomunicaciones no coinciden con el nombre, primer apellido y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "TC_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the telecom utility bill does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la factura de telecomunicaciones no coincide con la dirección postal registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Telecom utility bill_liberty",
+      "validations": [
+        {
+          "field": "FullName",
+          "validationType": "name_match",
+          "errorCode": "TL_FIRST_LAST_NAME_MISMATCH",
+          "message_en": "The first and last name on the telecom utility bill does not match the first name, fist last and second last name registered in your case.",
+          "message_es": "El nombre y apellido en la factura de telecomunicaciones no coinciden con el nombre, primer apellido y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "TL_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the telecom utility bill does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la factura de telecomunicaciones no coincide con la dirección postal registrada en su caso."
+        }
+      ]
+    },
+    {
+      "documentType": "Telecom utility bill_tmobile",
+      "validations": [
+        {
+          "field": "FullName",
+          "validationType": "name_match",
+          "errorCode": "TT_FIRST_LAST_NAME_MISMATCH",
+          "message_en": "The first and last name on the telecom utility bill does not match the firstname, fist last and second last name registered in your case.",
+          "message_es": "El nombre y apellido en la factura de telecomunicaciones no coinciden con el nombre, primer apellido y segundo apellido registrados en su caso."
+        },
+        {
+          "field": "Address",
+          "validationType": "address_match",
+          "errorCode": "TT_ADDRESS_MISMATCH",
+          "message_en": "The mailing address on the telecom utility bill does not match the postal address registered in your case.",
+          "message_es": "La dirección postal en la factura de telecomunicaciones no coincide con la dirección postal registrada en su caso."
+        }
+      ]
+    }
+  ]
+}
\ No newline at end of file