azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.41.2.15936",
      "templateHash": "1163612596131484209"
    }
  },
  "parameters": {
    "OrgName": {
      "type": "string",
      "minLength": 2,
      "metadata": {
        "description": "Name of the Company or Organization used for the Certificate Subject"
      }
    },
    "license": {
      "type": "string",
      "defaultValue": "trial",
      "metadata": {
        "description": "License Key for SCEPman"
      }
    },
    "keyVaultName": {
      "type": "string",
      "defaultValue": "kv-scepman-UNIQUENAME",
      "minLength": 3,
      "maxLength": 24,
      "metadata": {
        "description": "Specifies the name of the Azure Key Vault. The name of a Key Vault must be globally unique and contain only DNS-compatible characters (letters, numbers, and hyphens)."
      }
    },
    "caKeyType": {
      "type": "string",
      "defaultValue": "RSA-HSM",
      "allowedValues": [
        "RSA",
        "RSA-HSM"
      ],
      "metadata": {
        "description": "When generating the SCEPman CA certificate, which kind of key pair shall be created? RSA is a software-protected RSA key; RSA-HSM is HSM-protected."
      }
    },
    "storageAccountName": {
      "type": "string",
      "defaultValue": "stscepmanuniquename",
      "minLength": 3,
      "maxLength": 24,
      "metadata": {
        "description": "Choose a globally unique name for your storage account. Storage account names must be between 3 and 24 characters in length and may contain numbers and lowercase letters only."
      }
    },
    "appServicePlanName": {
      "type": "string",
      "defaultValue": "asp-scepman-UNIQUENAME",
      "maxLength": 40
    },
    "existingAppServicePlanID": {
      "type": "string",
      "defaultValue": "none",
      "metadata": {
        "description": "Provide the Resource ID of an existing App Service Plan (the long string displayed in the properties tab). Keep default value 'none' if you want to create a new one."
      }
    },
    "deployOnLinux": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Use Linux App Service Plan"
      }
    },
    "primaryAppServiceName": {
      "type": "string",
      "defaultValue": "app-scepman-UNIQUENAME",
      "maxLength": 60,
      "metadata": {
        "description": "The SCEPman App Service and part of the default FQDN. Therefore, it must be globally unique and contain only DNS-compatible characters."
      }
    },
    "logAnalyticsWorkspaceName": {
      "type": "string",
      "defaultValue": "log-scepman-UNIQUENAME",
      "minLength": 4,
      "maxLength": 63,
      "metadata": {
        "description": "The Log Analytics Workspace with log data. Alphanumerics and hyphens are allowed."
      }
    },
    "certificateMasterAppServiceName": {
      "type": "string",
      "defaultValue": "app-scepman-UNIQUENAME-cm",
      "maxLength": 60,
      "metadata": {
        "description": "The App Service for the component SCEPman Certificate Master. As it is part of the default FQDN, it must be globally unique and contain only DNS-compatible characters."
      }
    },
    "enableHealthCheck": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Enable the App Service health check."
      }
    },
    "deployPrivateNetwork": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "Choose 'true' to deploy SCEPman with a Virtual Network. In this case, you must also provide names for the parameters virtualNetworkName, privateEndpointForTableStorage, and privateEndpointForKeyVaultName."
      }
    },
    "virtualNetworkName": {
      "type": "string",
      "defaultValue": "vnet-scepman-UNIQUENAME",
      "maxLength": 80,
      "metadata": {
        "description": "The name of the Virtual Network. This is only applicable if deployPrivateNetwork is chosen."
      }
    },
    "nsgName": {
      "type": "string",
      "defaultValue": "nsg-scepman-UNIQUENAME",
      "maxLength": 80,
      "metadata": {
        "description": "Name of the Network Security Group applied to the subnets. This is only applicable if deployPrivateNetwork is chosen."
      }
    },
    "privateEndpointForKeyVaultName": {
      "type": "string",
      "defaultValue": "pep-kv-scepman-UNIQUENAME",
      "minLength": 4,
      "maxLength": 64,
      "metadata": {
        "description": "Name of the Private Endpoint for the Key Vault. This is only applicable if deployPrivateNetwork is chosen."
      }
    },
    "privateEndpointForTableStorage": {
      "type": "string",
      "defaultValue": "pep-sts-scepman-UNIQUENAME",
      "minLength": 4,
      "maxLength": 64,
      "metadata": {
        "description": "Name of the Private Endpoint for the Azure Table Storage Service. This is only applicable if deployPrivateNetwork is chosen."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]",
      "metadata": {
        "description": "Location for all resources. For a manual deployment, we recommend the default value."
      }
    },
    "resourceTags": {
      "type": "object",
      "defaultValue": {},
      "metadata": {
        "description": "Tags to be assigned to all created resources. Use JSON syntax, e.g. if you want to add tags env with value dev and project with value scepman, then write { \"env\":\"dev\", \"project\":\"scepman\"}."
      }
    }
  },
  "variables": {
    "artifactsRepositoryUrl": "https://raw.githubusercontent.com/scepman/install/master/",
    "ArtifactsLocationSCEPman": "[uri(variables('artifactsRepositoryUrl'), if(parameters('deployOnLinux'), 'dist/Artifacts-Linux.zip', 'dist/Artifacts.zip'))]",
    "ArtifactsLocationCertMaster": "[uri(variables('artifactsRepositoryUrl'), if(parameters('deployOnLinux'), 'dist-certmaster/CertMaster-Artifacts-Linux.zip', 'dist-certmaster/CertMaster-Artifacts.zip'))]",
    "appServiceNames": [
      "[parameters('primaryAppServiceName')]",
      "[parameters('certificateMasterAppServiceName')]"
    ]
  },
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "pid-a262352f-52a9-4ed9-a9ba-6a2b2478d19b-partnercenter",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {},
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "15050332927029945745"
            }
          },
          "resources": []
        }
      }
    },
    {
      "condition": "[parameters('deployPrivateNetwork')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "CreateVirtualNetwork",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          },
          "networkSecurityGroupName": {
            "value": "[parameters('nsgName')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "2200891563363908764"
            }
          },
          "parameters": {
            "virtualNetworkName": {
              "type": "string",
              "metadata": {
                "description": "Specifies the name of the Virtual Network."
              }
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "The Azure Region where the Virtual Network will be created."
              }
            },
            "resourceTags": {
              "type": "object",
              "metadata": {
                "description": "Tags to be assigned to the created resources."
              }
            },
            "networkSecurityGroupName": {
              "type": "string",
              "defaultValue": "[format('nsg-{0}', parameters('virtualNetworkName'))]",
              "metadata": {
                "description": "Name of the Network Security Group applied to the subnets."
              }
            },
            "virtualNetworkAddressPrefixes": {
              "type": "array",
              "defaultValue": [
                "10.142.0.0/16"
              ],
              "metadata": {
                "description": "List of address prefixes for the Virtual Network."
              }
            },
            "subnetIpPrefixDefault": {
              "type": "string",
              "defaultValue": "10.142.0.0/24",
              "metadata": {
                "description": "Subnet prefix for the default subnet"
              }
            },
            "subnetIpPrefixScepman": {
              "type": "string",
              "defaultValue": "10.142.1.0/24",
              "metadata": {
                "description": "Subnet prefix for the subnet that will host the App Services"
              }
            }
          },
          "resources": [
            {
              "type": "Microsoft.Network/networkSecurityGroups",
              "apiVersion": "2025-05-01",
              "name": "[parameters('networkSecurityGroupName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {}
            },
            {
              "type": "Microsoft.Network/virtualNetworks",
              "apiVersion": "2025-05-01",
              "name": "[parameters('virtualNetworkName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "addressSpace": {
                  "addressPrefixes": "[parameters('virtualNetworkAddressPrefixes')]"
                },
                "encryption": {
                  "enabled": false,
                  "enforcement": "AllowUnencrypted"
                },
                "subnets": [
                  {
                    "name": "default",
                    "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), 'default')]",
                    "properties": {
                      "addressPrefix": "[parameters('subnetIpPrefixDefault')]",
                      "privateEndpointNetworkPolicies": "Disabled",
                      "privateLinkServiceNetworkPolicies": "Enabled",
                      "defaultOutboundAccess": false,
                      "networkSecurityGroup": {
                        "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('networkSecurityGroupName'))]"
                      }
                    },
                    "type": "Microsoft.Network/virtualNetworks/subnets"
                  },
                  {
                    "name": "snet-scepman-appservices",
                    "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), 'snet-scepman-appservices')]",
                    "properties": {
                      "addressPrefix": "[parameters('subnetIpPrefixScepman')]",
                      "delegations": [
                        {
                          "name": "delegation",
                          "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets/delegations', parameters('virtualNetworkName'), 'snet-scepman-appservices', 'delegation')]",
                          "properties": {
                            "serviceName": "Microsoft.Web/serverfarms"
                          },
                          "type": "Microsoft.Network/virtualNetworks/subnets/delegations"
                        }
                      ],
                      "privateEndpointNetworkPolicies": "Disabled",
                      "privateLinkServiceNetworkPolicies": "Enabled",
                      "defaultOutboundAccess": false,
                      "networkSecurityGroup": {
                        "id": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('networkSecurityGroupName'))]"
                      }
                    },
                    "type": "Microsoft.Network/virtualNetworks/subnets"
                  }
                ],
                "enableDdosProtection": false
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('networkSecurityGroupName'))]"
              ]
            }
          ]
        }
      }
    },
    {
      "copy": {
        "name": "AppService_ConnectionToVirtualNetwork",
        "count": "[length(range(0, 2))]",
        "mode": "serial",
        "batchSize": 1
      },
      "condition": "[parameters('deployPrivateNetwork')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "[format('AppService-{0}-ConnectionToVirtualNetwork', range(0, 2)[copyIndex()])]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "appServiceName": {
            "value": "[variables('appServiceNames')[range(0, 2)[copyIndex()]]]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "11864849207678215448"
            }
          },
          "parameters": {
            "virtualNetworkName": {
              "type": "string",
              "metadata": {
                "description": "Name of the VNET"
              }
            },
            "appServiceName": {
              "type": "string",
              "metadata": {
                "description": "Name of App Service"
              }
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "Region in which to create the vnet connection."
              }
            }
          },
          "resources": [
            {
              "type": "Microsoft.Web/sites",
              "apiVersion": "2024-11-01",
              "name": "[parameters('appServiceName')]",
              "location": "[parameters('location')]",
              "properties": {
                "virtualNetworkSubnetId": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), 'snet-scepman-appservices')]"
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Resources/deployments', 'CreateVirtualNetwork')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "SCEPmanAppServices",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "AppServicePlanName": {
            "value": "[parameters('appServicePlanName')]"
          },
          "existingAppServicePlanID": {
            "value": "[parameters('existingAppServicePlanID')]"
          },
          "deployOnLinux": {
            "value": "[parameters('deployOnLinux')]"
          },
          "appServiceName": {
            "value": "[parameters('primaryAppServiceName')]"
          },
          "appServiceName2": {
            "value": "[parameters('certificateMasterAppServiceName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "5383047094207400530"
            }
          },
          "parameters": {
            "existingAppServicePlanID": {
              "type": "string",
              "defaultValue": "none",
              "metadata": {
                "description": "Provide the AppServicePlan ID of an existing App Service Plan. Keep default value 'none' if you want to create a new one."
              }
            },
            "AppServicePlanName": {
              "type": "string",
              "metadata": {
                "description": "Name of the App Service Plan to be created"
              }
            },
            "appServiceName": {
              "type": "string",
              "metadata": {
                "description": "Name of App Service to be created"
              }
            },
            "appServiceName2": {
              "type": "string",
              "metadata": {
                "description": "Name of second App Service to be created"
              }
            },
            "deployOnLinux": {
              "type": "bool",
              "metadata": {
                "description": "Use Linux App Service Plan"
              }
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "Resource Group"
              }
            },
            "resourceTags": {
              "type": "object",
              "metadata": {
                "description": "Tags to be assigned to the created resources"
              }
            }
          },
          "resources": [
            {
              "condition": "[equals(parameters('existingAppServicePlanID'), 'none')]",
              "type": "Microsoft.Web/serverfarms",
              "apiVersion": "2024-04-01",
              "name": "[parameters('AppServicePlanName')]",
              "location": "[parameters('location')]",
              "sku": {
                "tier": "Standard",
                "name": "[if(parameters('deployOnLinux'), 'P0V3', 'S1')]"
              },
              "kind": "[if(parameters('deployOnLinux'), 'linux', 'app')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "targetWorkerCount": 1,
                "reserved": "[parameters('deployOnLinux')]"
              }
            },
            {
              "type": "Microsoft.Web/sites",
              "apiVersion": "2024-04-01",
              "name": "[parameters('appServiceName')]",
              "location": "[parameters('location')]",
              "identity": {
                "type": "SystemAssigned"
              },
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "serverFarmId": "[if(equals(parameters('existingAppServicePlanID'), 'none'), resourceId('Microsoft.Web/serverfarms', parameters('AppServicePlanName')), parameters('existingAppServicePlanID'))]",
                "clientAffinityEnabled": false,
                "httpsOnly": false,
                "clientCertEnabled": true,
                "clientCertMode": "OptionalInteractiveUser",
                "siteConfig": {
                  "alwaysOn": true,
                  "http20Enabled": false,
                  "ftpsState": "Disabled",
                  "use32BitWorkerProcess": false,
                  "linuxFxVersion": "[if(parameters('deployOnLinux'), 'DOTNETCORE|8.0', null())]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/serverfarms', parameters('AppServicePlanName'))]"
              ]
            },
            {
              "type": "Microsoft.Web/sites",
              "apiVersion": "2024-04-01",
              "name": "[parameters('appServiceName2')]",
              "location": "[parameters('location')]",
              "identity": {
                "type": "SystemAssigned"
              },
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "serverFarmId": "[if(equals(parameters('existingAppServicePlanID'), 'none'), resourceId('Microsoft.Web/serverfarms', parameters('AppServicePlanName')), parameters('existingAppServicePlanID'))]",
                "clientAffinityEnabled": true,
                "httpsOnly": true,
                "siteConfig": {
                  "alwaysOn": true,
                  "http20Enabled": true,
                  "ftpsState": "Disabled",
                  "use32BitWorkerProcess": false,
                  "minTlsVersion": "1.3",
                  "linuxFxVersion": "[if(parameters('deployOnLinux'), 'DOTNETCORE|8.0', null())]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/serverfarms', parameters('AppServicePlanName'))]"
              ]
            }
          ],
          "outputs": {
            "scepmanURL": {
              "type": "string",
              "value": "[uri(format('https://{0}', reference(resourceId('Microsoft.Web/sites', parameters('appServiceName')), '2024-04-01').defaultHostName), '/')]"
            },
            "scepmanPrincipalID": {
              "type": "string",
              "value": "[reference(parameters('appServiceName'), '2022-03-01', 'Full').identity.principalId]"
            },
            "certmasterPrincipalID": {
              "type": "string",
              "value": "[reference(parameters('appServiceName2'), '2022-03-01', 'Full').identity.principalId]"
            },
            "appServicePlanID": {
              "type": "string",
              "value": "[if(equals(parameters('existingAppServicePlanID'), 'none'), resourceId('Microsoft.Web/serverfarms', parameters('AppServicePlanName')), parameters('existingAppServicePlanID'))]"
            }
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "AzureMonitor",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "logAnalyticsAccountName": {
            "value": "[parameters('logAnalyticsWorkspaceName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "10131361067590667248"
            }
          },
          "parameters": {
            "logAnalyticsAccountName": {
              "type": "string",
              "metadata": {
                "description": "Name of the Log Analytics Workspace"
              }
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "Location where the resources will be deployed"
              }
            },
            "resourceTags": {
              "type": "object",
              "metadata": {
                "description": "Tags to be assigned to the created resources"
              }
            }
          },
          "resources": [
            {
              "type": "Microsoft.OperationalInsights/workspaces",
              "apiVersion": "2025-07-01",
              "name": "[parameters('logAnalyticsAccountName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "retentionInDays": 30,
                "sku": {
                  "name": "PerGB2018"
                }
              }
            }
          ],
          "outputs": {
            "workspaceId": {
              "type": "string",
              "value": "[reference(resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsAccountName')), '2025-07-01').customerId]"
            }
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "SCEPmanVault",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "keyVaultName": {
            "value": "[parameters('keyVaultName')]"
          },
          "permittedPrincipalId": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices'), '2025-04-01').outputs.scepmanPrincipalID.value]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          },
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "privateEndpointName": "[if(parameters('deployPrivateNetwork'), createObject('value', parameters('privateEndpointForKeyVaultName')), createObject('value', 'None'))]"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "4578674048240313234"
            }
          },
          "parameters": {
            "keyVaultName": {
              "type": "string",
              "minLength": 3,
              "maxLength": 24,
              "metadata": {
                "description": "Specifies the name of the key vault."
              }
            },
            "permittedPrincipalId": {
              "type": "string",
              "metadata": {
                "description": "ID of SCEPman app service principal, whom will be assigned permissions to the KV"
              }
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "Region in which to create the key vault."
              }
            },
            "resourceTags": {
              "type": "object",
              "metadata": {
                "description": "Tags to be assigned to the created resources"
              }
            },
            "virtualNetworkName": {
              "type": "string",
              "metadata": {
                "description": "Name of the Virtual Network to associate with the key vault."
              }
            },
            "privateEndpointName": {
              "type": "string",
              "metadata": {
                "description": "Name of the private endpoint to be created for the key vault. Select 'None' to not create a private endpoint."
              }
            }
          },
          "variables": {
            "rbac_roles": [
              "14b46e9e-c2b7-41b4-b07b-48a6ebf60603",
              "a4417e6f-fecd-4de8-b567-7b0420556985",
              "4633458b-17de-408a-b874-0445c86b69e6"
            ]
          },
          "resources": [
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2025-05-01",
              "name": "[parameters('keyVaultName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "tenantId": "[subscription().tenantId]",
                "enabledForDeployment": false,
                "enabledForTemplateDeployment": false,
                "enablePurgeProtection": true,
                "enableSoftDelete": true,
                "enabledForDiskEncryption": false,
                "enableRbacAuthorization": true,
                "sku": {
                  "name": "premium",
                  "family": "A"
                },
                "publicNetworkAccess": "[if(equals(parameters('privateEndpointName'), 'None'), 'Enabled', 'Disabled')]",
                "networkAcls": {
                  "bypass": "None",
                  "defaultAction": "[if(equals(parameters('privateEndpointName'), 'None'), 'Allow', 'Deny')]"
                }
              }
            },
            {
              "copy": {
                "name": "roleAssignment_kv_rbac_roles",
                "count": "[length(variables('rbac_roles'))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
              "name": "[guid(format('roleAssignment-kv-{0}-{1}', variables('rbac_roles')[copyIndex()], parameters('permittedPrincipalId')))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', variables('rbac_roles')[copyIndex()])]",
                "principalId": "[parameters('permittedPrincipalId')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
              ]
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateDnsZones",
              "apiVersion": "2024-06-01",
              "name": "privatelink.vaultcore.azure.net",
              "location": "Global",
              "tags": "[parameters('resourceTags')]",
              "properties": {}
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateEndpoints",
              "apiVersion": "2025-05-01",
              "name": "[parameters('privateEndpointName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "subnet": {
                  "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), 'default')]"
                },
                "privateLinkServiceConnections": [
                  {
                    "name": "keyVault",
                    "properties": {
                      "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
                      "groupIds": [
                        "vault"
                      ],
                      "privateLinkServiceConnectionState": {
                        "status": "Approved",
                        "description": "Private endpoint connection approved",
                        "actionsRequired": "None"
                      }
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
              ]
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
              "apiVersion": "2025-05-01",
              "name": "[format('{0}/{1}', parameters('privateEndpointName'), 'default')]",
              "properties": {
                "privateDnsZoneConfigs": [
                  {
                    "name": "privatelink.vaultcore.azure.net",
                    "properties": {
                      "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.vaultcore.azure.net')]"
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateEndpoints', parameters('privateEndpointName'))]",
                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.vaultcore.azure.net')]"
              ]
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
              "apiVersion": "2024-06-01",
              "name": "[format('{0}/{1}', 'privatelink.vaultcore.azure.net', format('{0}-link', parameters('keyVaultName')))]",
              "location": "global",
              "properties": {
                "registrationEnabled": false,
                "virtualNetwork": {
                  "id": "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', 'privatelink.vaultcore.azure.net')]"
              ]
            }
          ],
          "outputs": {
            "keyVaultURL": {
              "type": "string",
              "value": "[reference(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), '2025-05-01').vaultUri]"
            }
          }
        }
      },
      "dependsOn": [
        "AppService_ConnectionToVirtualNetwork",
        "[resourceId('Microsoft.Resources/deployments', 'CreateVirtualNetwork')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanStorageAccount')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "DeploymentSCEPmanConfig",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "StorageAccountTableUrl": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanStorageAccount'), '2025-04-01').outputs.storageAccountTableUrl.value]"
          },
          "appServiceName": {
            "value": "[parameters('primaryAppServiceName')]"
          },
          "deployOnLinux": {
            "value": "[parameters('deployOnLinux')]"
          },
          "scepManBaseURL": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices'), '2025-04-01').outputs.scepmanURL.value]"
          },
          "keyVaultURL": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanVault'), '2025-04-01').outputs.keyVaultURL.value]"
          },
          "caKeyType": {
            "value": "[parameters('caKeyType')]"
          },
          "logAnalyticsWorkspaceId": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'AzureMonitor'), '2025-04-01').outputs.workspaceId.value]"
          },
          "logAnalyticsWorkspaceName": {
            "value": "[parameters('logAnalyticsWorkspaceName')]"
          },
          "OrgName": {
            "value": "[parameters('OrgName')]"
          },
          "WebsiteArtifactsUri": {
            "value": "[variables('ArtifactsLocationSCEPman')]"
          },
          "license": {
            "value": "[parameters('license')]"
          },
          "enableHealthCheck": {
            "value": "[parameters('enableHealthCheck')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "2939008030622145436"
            }
          },
          "functions": [
            {
              "namespace": "__bicep",
              "members": {
                "convertVariableNameToLinux": {
                  "parameters": [
                    {
                      "type": "string",
                      "name": "variableName"
                    },
                    {
                      "type": "bool",
                      "name": "deployOnLinux"
                    }
                  ],
                  "output": {
                    "type": "string",
                    "value": "[if(parameters('deployOnLinux'), replace(parameters('variableName'), ':', '__'), parameters('variableName'))]"
                  }
                }
              }
            }
          ],
          "parameters": {
            "StorageAccountTableUrl": {
              "type": "string",
              "metadata": {
                "description": "URL of the Storage Account's table endpoint to retrieve certificate information from"
              }
            },
            "appServiceName": {
              "type": "string",
              "metadata": {
                "description": "Name of SCEPman's app service"
              }
            },
            "scepManBaseURL": {
              "type": "string",
              "metadata": {
                "description": "Base URL of SCEPman"
              }
            },
            "keyVaultURL": {
              "type": "string",
              "metadata": {
                "description": "URL of the key vault"
              }
            },
            "OrgName": {
              "type": "string",
              "metadata": {
                "description": "Name of company or organization for certificate subject"
              }
            },
            "caKeyType": {
              "type": "string",
              "defaultValue": "RSA-HSM",
              "allowedValues": [
                "RSA",
                "RSA-HSM"
              ],
              "metadata": {
                "description": "When generating the SCEPman CA certificate, which kind of key pair shall be created? RSA is a software-protected RSA key; RSA-HSM is HSM-protected."
              }
            },
            "caKeySize": {
              "type": "int",
              "defaultValue": 4096,
              "metadata": {
                "description": "When generating the SCEPman CA certificate, what length in bits shall the key have? Plausible values for RSA are 2048 or 4096. The size also has an impact on the Azure Key Vault pricing."
              }
            },
            "logAnalyticsWorkspaceId": {
              "type": "string",
              "metadata": {
                "description": "Log Analytics Workspace ID"
              }
            },
            "logAnalyticsWorkspaceName": {
              "type": "string",
              "metadata": {
                "description": "Log Analytics Workspace name"
              }
            },
            "license": {
              "type": "string",
              "defaultValue": "trial",
              "metadata": {
                "description": "License Key for SCEPman"
              }
            },
            "WebsiteArtifactsUri": {
              "type": "string",
              "metadata": {
                "description": "The full URI where SCEPman artifact binaries are stored"
              }
            },
            "deployOnLinux": {
              "type": "bool",
              "metadata": {
                "description": "Use Linux App Service Plan"
              }
            },
            "enableHealthCheck": {
              "type": "bool",
              "metadata": {
                "description": "Enable health check"
              }
            }
          },
          "resources": {
            "appServiceName_appsettings": {
              "type": "Microsoft.Web/sites/config",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/appsettings', parameters('appServiceName'))]",
              "properties": {
                "WEBSITE_RUN_FROM_PACKAGE": "[parameters('WebsiteArtifactsUri')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:BaseUrl', parameters('deployOnLinux')))]": "[parameters('scepManBaseURL')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:LicenseKey', parameters('deployOnLinux')))]": "[parameters('license')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:AuthConfig:TenantId', parameters('deployOnLinux')))]": "[subscription().tenantId]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:UseRequestedKeyUsages', parameters('deployOnLinux')))]": "true",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:ValidityPeriodDays', parameters('deployOnLinux')))]": "730",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:IntuneValidation:ValidityPeriodDays', parameters('deployOnLinux')))]": "365",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:DirectCSRValidation:Enabled', parameters('deployOnLinux')))]": "true",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:DbCSRValidation:ReenrollmentAllowedCertificateTypes', parameters('deployOnLinux')))]": "Static",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:IntuneValidation:DeviceDirectory', parameters('deployOnLinux')))]": "AADAndIntune",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:CRL:Source', parameters('deployOnLinux')))]": "Storage",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:EnableCertificateStorage', parameters('deployOnLinux')))]": "true",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:LoggingConfig:WorkspaceId', parameters('deployOnLinux')))]": "[parameters('logAnalyticsWorkspaceId')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:LoggingConfig:SharedKey', parameters('deployOnLinux')))]": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName')), '2025-07-01').primarySharedKey]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:KeyVaultConfig:KeyVaultURL', parameters('deployOnLinux')))]": "[parameters('keyVaultURL')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:CertificateStorage:TableStorageEndpoint', parameters('deployOnLinux')))]": "[parameters('StorageAccountTableUrl')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:KeyVaultConfig:RootCertificateConfig:CertificateName', parameters('deployOnLinux')))]": "SCEPman-Root-CA-V1",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:KeyVaultConfig:RootCertificateConfig:KeyType', parameters('deployOnLinux')))]": "[parameters('caKeyType')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:KeyVaultConfig:RootCertificateConfig:KeySize', parameters('deployOnLinux')))]": "[parameters('caKeySize')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:KeyVaultConfig:RootCertificateConfig:Subject', parameters('deployOnLinux')))]": "[format('CN=SCEPman-Root-CA-V1, OU={0}, O=\"{1}\"', subscription().tenantId, parameters('OrgName'))]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:OCSP:UseAuthorizedResponder', parameters('deployOnLinux')))]": "true",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:ValidityClockSkewMinutes', parameters('deployOnLinux')))]": "1440"
              }
            },
            "appServiceName_websettings": {
              "condition": "[parameters('enableHealthCheck')]",
              "type": "Microsoft.Web/sites/config",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/web', parameters('appServiceName'))]",
              "properties": {
                "healthCheckPath": "/probe"
              }
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Resources/deployments', 'AzureMonitor')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanStorageAccount')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanVault')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "DeploymentCertMasterConfig",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "appServiceName": {
            "value": "[parameters('certificateMasterAppServiceName')]"
          },
          "deployOnLinux": {
            "value": "[parameters('deployOnLinux')]"
          },
          "scepmanUrl": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices'), '2025-04-01').outputs.scepmanURL.value]"
          },
          "StorageAccountTableUrl": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanStorageAccount'), '2025-04-01').outputs.storageAccountTableUrl.value]"
          },
          "logAnalyticsWorkspaceId": {
            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'AzureMonitor'), '2025-04-01').outputs.workspaceId.value]"
          },
          "logAnalyticsWorkspaceName": {
            "value": "[parameters('logAnalyticsWorkspaceName')]"
          },
          "WebsiteArtifactsUri": {
            "value": "[variables('ArtifactsLocationCertMaster')]"
          },
          "enableHealthCheck": {
            "value": "[parameters('enableHealthCheck')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "10009939816769082358"
            }
          },
          "functions": [
            {
              "namespace": "__bicep",
              "members": {
                "convertVariableNameToLinux": {
                  "parameters": [
                    {
                      "type": "string",
                      "name": "variableName"
                    },
                    {
                      "type": "bool",
                      "name": "deployOnLinux"
                    }
                  ],
                  "output": {
                    "type": "string",
                    "value": "[if(parameters('deployOnLinux'), replace(parameters('variableName'), ':', '__'), parameters('variableName'))]"
                  }
                }
              }
            }
          ],
          "parameters": {
            "StorageAccountTableUrl": {
              "type": "string",
              "metadata": {
                "description": "URL of the Storage Account's table endpoint to store certificate information"
              }
            },
            "WebsiteArtifactsUri": {
              "type": "string",
              "metadata": {
                "description": "The full URI where CertMaster artifact binaries are stored"
              }
            },
            "appServiceName": {
              "type": "string",
              "metadata": {
                "description": "Name of Certificate Master's app service"
              }
            },
            "scepmanUrl": {
              "type": "string",
              "metadata": {
                "description": "The URL of the SCEPman App Service"
              }
            },
            "logAnalyticsWorkspaceId": {
              "type": "string",
              "metadata": {
                "description": "Log Analytics Workspace ID"
              }
            },
            "logAnalyticsWorkspaceName": {
              "type": "string",
              "metadata": {
                "description": "Log Analytics Workspace name"
              }
            },
            "deployOnLinux": {
              "type": "bool",
              "metadata": {
                "description": "Use Linux App Service Plan"
              }
            },
            "enableHealthCheck": {
              "type": "bool",
              "metadata": {
                "description": "Enable health check"
              }
            }
          },
          "resources": {
            "appServiceName_appsettings": {
              "type": "Microsoft.Web/sites/config",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/appsettings', parameters('appServiceName'))]",
              "properties": {
                "WEBSITE_RUN_FROM_PACKAGE": "[parameters('WebsiteArtifactsUri')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:AzureStorage:TableStorageEndpoint', parameters('deployOnLinux')))]": "[parameters('StorageAccountTableUrl')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:SCEPman:URL', parameters('deployOnLinux')))]": "[parameters('scepmanUrl')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:AuthConfig:TenantId', parameters('deployOnLinux')))]": "[subscription().tenantId]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:LoggingConfig:WorkspaceId', parameters('deployOnLinux')))]": "[parameters('logAnalyticsWorkspaceId')]",
                "[format('{0}', __bicep.convertVariableNameToLinux('AppConfig:LoggingConfig:SharedKey', parameters('deployOnLinux')))]": "[listKeys(resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName')), '2025-07-01').primarySharedKey]"
              }
            },
            "appServiceName_websettings": {
              "condition": "[parameters('enableHealthCheck')]",
              "type": "Microsoft.Web/sites/config",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/web', parameters('appServiceName'))]",
              "properties": {
                "healthCheckPath": "/probe"
              }
            }
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Resources/deployments', 'AzureMonitor')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanStorageAccount')]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "SCEPmanStorageAccount",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "StorageAccountName": {
            "value": "[parameters('storageAccountName')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "resourceTags": {
            "value": "[parameters('resourceTags')]"
          },
          "tableContributorPrincipals": {
            "value": [
              "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices'), '2025-04-01').outputs.scepmanPrincipalID.value]",
              "[reference(resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices'), '2025-04-01').outputs.certmasterPrincipalID.value]"
            ]
          },
          "virtualNetworkName": {
            "value": "[parameters('virtualNetworkName')]"
          },
          "privateEndpointName": "[if(parameters('deployPrivateNetwork'), createObject('value', parameters('privateEndpointForTableStorage')), createObject('value', 'None'))]"
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.41.2.15936",
              "templateHash": "9268726593796951249"
            }
          },
          "parameters": {
            "StorageAccountName": {
              "type": "string",
              "metadata": {
                "description": "Name of the storage account"
              }
            },
            "location": {
              "type": "string",
              "metadata": {
                "description": "Location where the resources will be deployed"
              }
            },
            "resourceTags": {
              "type": "object",
              "metadata": {
                "description": "Tags to be assigned to the created resources"
              }
            },
            "tableContributorPrincipals": {
              "type": "array",
              "metadata": {
                "description": "IDs of Principals that shall receive table contributor rights on the storage account"
              }
            },
            "virtualNetworkName": {
              "type": "string",
              "metadata": {
                "description": "Name of the Virtual Network to associate with the table service of the storage account."
              }
            },
            "privateEndpointName": {
              "type": "string",
              "metadata": {
                "description": "Name of the private endpoint to be created for the table service of the storage account. Pass 'None' if you don't want to create a private endpoint."
              }
            }
          },
          "variables": {
            "privateDnsZoneName": "[format('privatelink.table.{0}', environment().suffixes.storage)]",
            "gzrsRegions": [
              "australiaeast",
              "brazilsouth",
              "canadacentral",
              "centralindia",
              "centralus",
              "eastasia",
              "eastus",
              "eastus2",
              "francecentral",
              "germanywestcentral",
              "japaneast",
              "japanwest",
              "koreacentral",
              "northeurope",
              "norwayeast",
              "southafricanorth",
              "southcentralus",
              "southeastasia",
              "swedencentral",
              "switzerlandnorth",
              "uaenorth",
              "uksouth",
              "westeurope",
              "westus2",
              "westus3",
              "usgovvirginia",
              "chinanorth3"
            ],
            "zrsRegions": [
              "australiaeast",
              "austriaeast",
              "belgiumcentral",
              "brazilsouth",
              "canadacentral",
              "centralindia",
              "centralus",
              "chilecentral",
              "eastasia",
              "eastus",
              "eastus2",
              "francecentral",
              "germanywestcentral",
              "indonesiacentral",
              "israelcentral",
              "italynorth",
              "japaneast",
              "japanwest",
              "koreacentral",
              "malaysiawest",
              "mexicocentral",
              "newzealandnorth",
              "northeurope",
              "norwayeast",
              "polandcentral",
              "qatarcentral",
              "southafricanorth",
              "southcentralus",
              "southeastasia",
              "spaincentral",
              "swedencentral",
              "switzerlandnorth",
              "uaenorth",
              "uksouth",
              "westeurope",
              "westus2",
              "westus3",
              "usgovvirginia",
              "chinanorth3"
            ],
            "geoRedundantRegions": [
              "australiacentral",
              "australiacentral2",
              "australiaeast",
              "australiasoutheast",
              "brazilsouth",
              "brazilsoutheast",
              "canadacentral",
              "canadaeast",
              "centralindia",
              "centralus",
              "eastasia",
              "eastus",
              "eastus2",
              "francecentral",
              "francesouth",
              "germanynorth",
              "germanywestcentral",
              "japaneast",
              "japanwest",
              "koreacentral",
              "koreasouth",
              "northcentralus",
              "northeurope",
              "norwayeast",
              "norwaywest",
              "southafricanorth",
              "southafricawest",
              "southcentralus",
              "southindia",
              "southeastasia",
              "swedencentral",
              "switzerlandnorth",
              "switzerlandwest",
              "uaecentral",
              "uaenorth",
              "uksouth",
              "ukwest",
              "westcentralus",
              "westeurope",
              "westindia",
              "westus",
              "westus2",
              "westus3",
              "usgovvirginia",
              "usgovarizona",
              "usgovtexas",
              "usdodcentral",
              "usdodeast",
              "chinaeast",
              "chinaeast2",
              "chinaeast3",
              "chinanorth",
              "chinanorth2",
              "chinanorth3"
            ],
            "storageAccountSku": "[if(contains(variables('gzrsRegions'), parameters('location')), 'Standard_GZRS', if(contains(variables('geoRedundantRegions'), parameters('location')), 'Standard_GRS', if(contains(variables('zrsRegions'), parameters('location')), 'Standard_ZRS', 'Standard_LRS')))]"
          },
          "resources": [
            {
              "type": "Microsoft.Storage/storageAccounts",
              "apiVersion": "2025-06-01",
              "name": "[parameters('StorageAccountName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "sku": {
                "name": "[variables('storageAccountSku')]"
              },
              "kind": "StorageV2",
              "properties": {
                "accessTier": "Hot",
                "allowBlobPublicAccess": false,
                "allowCrossTenantReplication": false,
                "allowSharedKeyAccess": false,
                "isHnsEnabled": false,
                "isNfsV3Enabled": false,
                "minimumTlsVersion": "TLS1_2",
                "supportsHttpsTrafficOnly": true,
                "publicNetworkAccess": "[if(equals(parameters('privateEndpointName'), 'None'), 'Enabled', 'Disabled')]",
                "networkAcls": {
                  "bypass": "None",
                  "defaultAction": "[if(equals(parameters('privateEndpointName'), 'None'), 'Allow', 'Deny')]"
                }
              }
            },
            {
              "copy": {
                "name": "roleAssignment_sa_tableContributorPrincipals",
                "count": "[length(parameters('tableContributorPrincipals'))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName'))]",
              "name": "[guid(format('roleAssignment-sa-{0}-tableContributor', parameters('tableContributorPrincipals')[copyIndex()]))]",
              "properties": {
                "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
                "principalId": "[parameters('tableContributorPrincipals')[copyIndex()]]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName'))]"
              ]
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateDnsZones",
              "apiVersion": "2024-06-01",
              "name": "[variables('privateDnsZoneName')]",
              "location": "Global",
              "tags": "[parameters('resourceTags')]",
              "properties": {}
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateEndpoints",
              "apiVersion": "2025-05-01",
              "name": "[parameters('privateEndpointName')]",
              "location": "[parameters('location')]",
              "tags": "[parameters('resourceTags')]",
              "properties": {
                "subnet": {
                  "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', parameters('virtualNetworkName'), 'default')]"
                },
                "privateLinkServiceConnections": [
                  {
                    "name": "tableStorageConnection",
                    "properties": {
                      "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName'))]",
                      "groupIds": [
                        "table"
                      ],
                      "privateLinkServiceConnectionState": {
                        "status": "Approved",
                        "description": "Private endpoint connection approved",
                        "actionsRequired": "None"
                      }
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName'))]"
              ]
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
              "apiVersion": "2025-05-01",
              "name": "[format('{0}/{1}', parameters('privateEndpointName'), 'default')]",
              "properties": {
                "privateDnsZoneConfigs": [
                  {
                    "name": "[variables('privateDnsZoneName')]",
                    "properties": {
                      "privateDnsZoneId": "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneName'))]"
                    }
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneName'))]",
                "[resourceId('Microsoft.Network/privateEndpoints', parameters('privateEndpointName'))]"
              ]
            },
            {
              "condition": "[not(equals(parameters('privateEndpointName'), 'None'))]",
              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
              "apiVersion": "2024-06-01",
              "name": "[format('{0}/{1}', variables('privateDnsZoneName'), format('{0}-link', parameters('StorageAccountName')))]",
              "location": "global",
              "properties": {
                "registrationEnabled": false,
                "virtualNetwork": {
                  "id": "[resourceId('Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]"
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Network/privateDnsZones', variables('privateDnsZoneName'))]"
              ]
            }
          ],
          "outputs": {
            "storageAccountTableUrl": {
              "type": "string",
              "value": "[reference(resourceId('Microsoft.Storage/storageAccounts', parameters('StorageAccountName')), '2025-06-01').primaryEndpoints.table]"
            }
          }
        }
      },
      "dependsOn": [
        "AppService_ConnectionToVirtualNetwork",
        "[resourceId('Microsoft.Resources/deployments', 'CreateVirtualNetwork')]",
        "[resourceId('Microsoft.Resources/deployments', 'SCEPmanAppServices')]"
      ]
    }
  ]
}